CVE-2026-119424
Medium · 6.8CVSS
6.8
EPSS
—
Published
Oct 30, 2026
CISA due date
—
The record
OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields. Attackers can place newlines in wpa.identity, wpa.passphrase, or RADIUS shared secrets to append arbitrary wpa_supplicant or hostapd directives loaded by root-run daemons.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119560 OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows… CWE-93
- CVE-2026-119417 CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0… CWE-93
- CVE-2026-119415 CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that… CWE-93
- CVE-2026-115303 The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF… CWE-93
- CVE-2026-118371 LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto… CWE-93
- CVE-2026-118372 LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows… CWE-93
- CVE-2026-115785 An SMTP command injection vulnerability in the data-source testing functionality of… CWE-93
- CVE-2026-114720 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command… CWE-93