CVE-2026-34578

{
  "id": "CVE-2026-34578",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-09T15:16:10.777",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ldap_escape(). An unauthenticated attacker can inject LDAP filter metacharacters into the username field of the WebGUI login page to enumerate valid LDAP usernames in the configured directory. When the LDAP server configuration includes an Extended Query to restrict login to members of a specific group, the same injection can be used to bypass that group membership restriction and authenticate as any LDAP user whose password is known, regardless of group membership. This vulnerability is fixed in 26.1.6."
    },
    {
      "lang": "es",
      "value": "OPNsense es una plataforma de cortafuegos y enrutamiento basada en FreeBSD. Antes de la versión 26.1.6, el conector de autenticación LDAP de OPNsense pasa el nombre de usuario de inicio de sesión directamente a un filtro de búsqueda LDAP sin llamar a ldap_escape(). Un atacante no autenticado puede inyectar metacaracteres de filtro LDAP en el campo de nombre de usuario de la página de inicio de sesión de la WebGUI para enumerar nombres de usuario LDAP válidos en el directorio configurado. Cuando la configuración del servidor LDAP incluye una Consulta Extendida para restringir el inicio de sesión a miembros de un grupo específico, la misma inyección puede usarse para eludir esa restricción de membresía de grupo y autenticarse como cualquier usuario LDAP cuya contraseña sea conocida, independientemente de la membresía de grupo. Esta vulnerabilidad se corrige en la versión 26.1.6."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "opnsense",
          "product": "core",
          "versions": [
            {
              "version": "< 26.1.6",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-09T17:45:17.527281Z",
          "id": "CVE-2026-34578",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-90"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "26.1.6",
              "matchCriteriaId": "651745DD-B6F9-404D-8F67-A82F0C649470"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/opnsense/core/commit/016f66cb4620cd48183fa97843f343bb71813c6e",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/opnsense/core/security/advisories/GHSA-jpm7-f59c-mp54",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/opnsense/core/security/advisories/GHSA-jpm7-f59c-mp54",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}