OPNsense CVE-2026-57155 (CVSS 3.1 9.9): Firewall Alias GeoIP importer lets a low-privileged Alias Edit user write files as root and reach root code execution; CVEs published 15 Oct for the July 26.1.11 / 26.4.1p1 patch set (also log-forgery 8.1, OpenVPN XSS-to-RCE 8.0, readonly bypass 7.1)

CVE records published on 15 October 2026 assign identifiers to a July 2026 OPNsense security patch set. The lead issue is CVE-2026-57155 (GitHub GHSA-wjqq-rfmm-v5h3, CVSS 3.1 9.9 Critical): the Firewall Alias GeoIP importer downloads a country-IP database from a user-supplied URL and unpacks it as root. An unsanitized country_code field from the CSV is used as the output filename under /usr/local/share/GeoIP/alias, so a user who only holds Firewall Alias Edit can point the importer at a server they control and write attacker-chosen content to an attacker-chosen path as root (directory traversal). That arbitrary root write can be turned into root code execution via the default newsyslog hourly cron. Researcher write-up (HackerAsk, 1 Jul 2026) and the advisory say the chain was reproduced on 26.1.6_2 and 26.1.10. Related CVEs in the same fixed builds: CVE-2026-63442 (CVSS 3.1 8.1 High) — unauthenticated WebGUI login username CRLF log forgery that can add a victim IP to the sshlockout pf table (adjacent network); CVE-2026-58390 (CVSS 3.1 8.0 High) — stored XSS to root RCE via OpenVPN client common_name in status views; CVE-2026-71490 (CVSS 3.1 7.1 High) — comma-separated direct user privileges bypass MVC user-config-readonly write protection; plus several medium XSS/XPath issues. Vulnerable: OPNsense core <= 26.1.10 and <= 26.4.1. Patched: 26.1.11 and 26.4.1p1 (GitHub advisory patched_versions). No known public mass exploitation is stated in the CVE records. Primary: OPNsense GHSA-wjqq-rfmm-v5h3; CVE.org published 15 Oct.

Product

OPNsense (FreeBSD firewall/routing platform) — Firewall Alias GeoIP importer and related WebGUI/MVC paths

Versions

Vulnerable: OPNsense core <= 26.1.10 and <= 26.4.1. Patched: 26.1.11 and 26.4.1p1 (GitHub advisory).

CVSS

9.9 (CVE-2026-57155, CVSS 3.1 Critical); also 8.1 (CVE-2026-63442), 8.0 (CVE-2026-58390), 7.1 (CVE-2026-71490) — GitHub/CVE records

Exploited in Australia?

unknown

Patch to

Upgrade OPNsense to 26.1.11 or 26.4.1p1 (or a later build that includes those fixes). Until then: remove Firewall Alias Edit from accounts that do not need it, do not allow untrusted users to set GeoIP source URLs, keep the WebGUI off the public internet, and review alias/GeoIP and OpenVPN status configuration for unexpected sources.

Primary: OPNsense GHSA-wjqq-rfmm-v5h3 — Root RCE via arbitrary file write in GeoIP Alias Importer (CVE-2026-57155) · Vendor: OPNsense core — GitHub security advisories · CVE: CVE-2026-57155, CVE-2026-63442, CVE-2026-58390, CVE-2026-71490 · CVE.org — CVE-2026-57155 (published 15 Oct 2026); researcher write-up: hackerask.com/posts/opnsense (1 Jul 2026)

vulnerabilities network