CVE-2026-63442 | OPNsense up to 26.1.10 WebGUI Login syslog-ng-lockout.conf readline usernamefld injection

October 15, 2026 Yanac

A vulnerability was found in OPNsense up to 26.1.10 and classified as critical. The affected element is the function readline of the file syslog-ng-lockout.conf of the component WebGUI Login. The manipulation of the argument usernamefld results in injection.

This vulnerability is known as CVE-2026-63442. It is possible to launch the attack remotely. No exploit is available.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More