CVE-2026-34578

{"id": "CVE-2026-34578", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34578", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-09T17:45:17.527281Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "opnsense", "product": "core", "versions": [{"status": "affected", "version": "< 26.1.6"}]}]}], "published": "2026-04-09T15:16:10.777", "references": [{"url": "https://github.com/opnsense/core/commit/016f66cb4620cd48183fa97843f343bb71813c6e", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/opnsense/core/security/advisories/GHSA-jpm7-f59c-mp54", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/opnsense/core/security/advisories/GHSA-jpm7-f59c-mp54", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-90"}]}], "descriptions": [{"lang": "en", "value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ldap_escape(). An unauthenticated attacker can inject LDAP filter metacharacters into the username field of the WebGUI login page to enumerate valid LDAP usernames in the configured directory. When the LDAP server configuration includes an Extended Query to restrict login to members of a specific group, the same injection can be used to bypass that group membership restriction and authenticate as any LDAP user whose password is known, regardless of group membership. This vulnerability is fixed in 26.1.6."}, {"lang": "es", "value": "OPNsense es una plataforma de cortafuegos y enrutamiento basada en FreeBSD. Antes de la versi\u00f3n 26.1.6, el conector de autenticaci\u00f3n LDAP de OPNsense pasa el nombre de usuario de inicio de sesi\u00f3n directamente a un filtro de b\u00fasqueda LDAP sin llamar a ldap_escape(). Un atacante no autenticado puede inyectar metacaracteres de filtro LDAP en el campo de nombre de usuario de la p\u00e1gina de inicio de sesi\u00f3n de la WebGUI para enumerar nombres de usuario LDAP v\u00e1lidos en el directorio configurado. Cuando la configuraci\u00f3n del servidor LDAP incluye una Consulta Extendida para restringir el inicio de sesi\u00f3n a miembros de un grupo espec\u00edfico, la misma inyecci\u00f3n puede usarse para eludir esa restricci\u00f3n de membres\u00eda de grupo y autenticarse como cualquier usuario LDAP cuya contrase\u00f1a sea conocida, independientemente de la membres\u00eda de grupo. Esta vulnerabilidad se corrige en la versi\u00f3n 26.1.6."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "651745DD-B6F9-404D-8F67-A82F0C649470", "versionEndExcluding": "26.1.6"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}