OPNsense Vulnerability Lets Users Escalate to Root via GeoIP Imports

OPNsense, a FreeBSD-based firewall and routing platform, contains a critical security flaw that allows users to escalate privileges to root. The vulnerability, tracked as CVE-2026-57155, affects versions prior to 26.1.11. According to the National Vulnerability Database, the flaw stems from how the system processes GeoIP imports. Organizations using this firewall software need to verify their version numbers immediately, as the exploit requires specific user privileges to execute.

The risk

The vulnerability arises in the Firewall Alias GeoIP importer scripts within the OPNsense codebase. The process_zip() and process_gzip() functions in the geoip.py library fail to validate CSV country_code values. An attacker with Firewall Alias Edit privilege can configure a malicious GeoIP source URL. By supplying an archive with a crafted country code, the attacker forces the system to write files outside the intended directory.

This path traversal attack writes attacker-controlled content as root files with IPv4 or IPv6 suffixes. The National Vulnerability Database lists the weaknesses as CWE-22, CWE-73, and CWE-78. Once these files are written, an attacker can create a crafted newsyslog fragment. Combined with an oversized log file, this triggers the default hourly root cron job. This sequence allows the execution of arbitrary commands as root, resulting in complete firewall compromise.

Who is exposed

Any organization running OPNsense versions older than 26.1.11 is exposed to this threat. The exploit relies on internal user privileges. Specifically, any account with Firewall Alias Edit rights can initiate the attack chain. This includes administrative staff or IT support personnel who have been granted this specific permission level. Organizations should review which accounts hold these privileges to assess their exposure.

Cost and compliance

The source material does not provide specific data on financial costs or compliance implications. However, a complete firewall compromise can lead to significant operational disruption. Organizations should review their incident response plans to ensure they can address such a severe breach if it occurs. The National Vulnerability Database notes that the issue is fixed in version 26.1.11.

What happens next

OPNsense has released version 26.1.11 to fix this issue. Administrators should update their systems to this version as soon as possible. Until the update is applied, organizations should restrict Firewall Alias Edit privileges to only those who absolutely need them. Monitoring for unusual file creation in the /usr/local/share/GeoIP/alias directory may help detect early signs of exploitation.

Questions to ask your suppliers

Teams should ask managed service providers if they have updated all OPNsense instances to the patched version. Inquire about the process for verifying that no unauthorized GeoIP sources were configured recently. Check whether the provider monitors for unusual cron job executions or file writes in system directories. Ensure that your internal IT team knows which accounts hold Firewall Alias Edit privileges. Ask if there is a policy to regularly audit user permissions on critical infrastructure. Confirm that backup procedures are secure and not vulnerable to similar path traversal attacks.

Background: Firewalls

Firewalls are important because they enforce access policies at network boundaries, blocking unauthorized traffic before it reaches your devices. Without this filter, your systems face constant probing. This reduces the attack surface and prevents automated exploits from finding vulnerable services.

Read the full guide: Why Firewalls Are Important: The Hidden Costs of Missing Filters

What to do and how to stay safe: OPNsense

• Update OPNsense to version 26.1.11 or later to apply the official fix.
• Audit user accounts to ensure only necessary personnel have Firewall Alias Edit privileges.
• Monitor system logs for unexpected file creations in the GeoIP alias directory.
• Review cron job configurations to detect any unauthorized modifications.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-57155?

The CVSS score is 9.9, which is rated as critical.

Which OPNsense versions are affected by this vulnerability?

All versions prior to 26.1.11 are affected.

What privileges are needed to exploit this flaw?

A user needs Firewall Alias Edit privilege to configure the malicious GeoIP source.