Unrated

Stored XPath Injection in OPNsense Certificate Authority Management

IdentifiersCVE-2026-53582CWE-643

CVE-2026-53582 is a stored XPath injection vulnerability in OPNsense affecting certificate authority management functionality exposed through the trust and CA management API. The flaw arises because a user-controllable reference identifier field is incorporated into an XPath expression executed against the system configuration without sufficient validation or neutralization of XPath metacharacters. Specifically, the vulnerable logic performs an XPath lookup using attacker-influenced input when resolving references in the configuration data, allowing a low-privileged user with certificate-related management permissions to persist a crafted payload and later trigger XPath evaluation against config.xml. This enables extraction of sensitive configuration values through a boolean oracle exposed by API responses. Disclosed examples include private keys, password hashes, synchronization credentials, and API secrets stored in the configuration. The issue can result in privilege escalation and may create a path to remote code execution depending on the secrets exposed and the deployment context.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows disclosure of sensitive values stored in the OPNsense configuration, including cryptographic private keys, password hashes, synchronization credentials, and API credentials. Because the vulnerable functionality is reachable by a user with only CA manager or certificate manager permissions, the flaw enables privilege escalation from a limited administrative role to broader compromise of the firewall or associated services. Exposure of administrative credentials or service secrets can facilitate takeover of management functions, lateral movement into integrated systems, interception or impersonation of VPN services, and potentially remote code execution if recovered secrets permit authenticated access to privileged execution paths.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, restrict access to certificate authority and certificate manager functionality to the smallest possible set of trusted administrators, and monitor for suspicious modifications to CA-related objects and repeated API queries indicative of boolean-oracle exfiltration. As a temporary workaround, apply strict server-side validation to the affected reference identifier field, such as a regular-expression guard and corresponding input mask, to block XPath metacharacters and enforce an expected identifier format. Additional defensive measures include reducing exposure of sensitive secrets in configuration where feasible and reviewing for possible CSRF hardening if the environment relies on browser-based administrative workflows.

Remediation

Patch, then assume compromise.

Upgrade OPNsense to version 26.1.10 or later, which is identified as containing the fix for this vulnerability. The underlying remediation is to prevent untrusted input from being embedded directly into XPath expressions by enforcing strict validation on the reference identifier field and ensuring only expected safe characters or formats are accepted. Any code path that constructs XPath queries from configuration-backed user input should be reviewed and corrected to eliminate injection opportunities.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

3 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3