CVE-2026-119560
OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
0th
OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php to inject directives loaded by ntpd running as root.
| CWE | CWE-93 |
| Vendor | opnsense |
| Product | core |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for opnsense core
Be the first to know when new medium vulnerabilities affecting opnsense core are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low
Affected Versions
opnsense / core
0 ≤ 26.7.8
References
github.com: https://github.com/opnsense/core/blob/26.7.8/src/etc/inc/plugins.inc.d/ntpd.inc#L285-L312 github.com: https://github.com/opnsense/core/blob/26.7.8/src/www/services_ntpd_gps.php#L49 github.com: https://github.com/opnsense/core/security/advisories/GHSA-fq94-cxvc-9r7w abraxaslabs.tech: https://abraxaslabs.tech/research/opnsense-ntp-gps-fudge github.com: https://github.com/opnsense/core vulncheck.com: https://www.vulncheck.com/advisories/opnsense-core-through-26.7.8-ntp-configuration-injection-via-gps-and-pps-fudge-fields
Credits
Abraxas Labs