CVE-2026-45158

Critical

Published: 13/05/2026(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.8, unsanitized user input was passed to the DHCP configuration, allowing remote code execution as root on the underlying operating system.

Risk Assessment

This vulnerability poses a serious security risk, allowing attackers to remotely take control of the operating system.

Recommendation

It is recommended to upgrade to version 26.1.8 or later to mitigate this vulnerability.

Original NVD description (English source)

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell script, allowing remote code execution as root on the underlying operating system. This vulnerability is fixed in 26.1.8.