CVE-2026-119560

    Dashboard / Vulnerabilities / CVE-2026-119560

    CVE-2026-119560

    Published: 30 Oct 2026Last Modified: 4 Nov 2026

    Summary: OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields

    Details: OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php to inject directives loaded by ntpd running as root.

    References: https://abraxaslabs.tech/research/opnsense-ntp-gps-fudge, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119560.json, https://github.com/opnsense/core/security/advisories/GHSA-fq94-cxvc-9r7w, https://nvd.nist.gov/vuln/detail/CVE-2026-119560, https://www.vulncheck.com/advisories/opnsense-core-through-26.7.8-ntp-configuration-injection-via-gps-and-pps-fudge-fields, https://github.com/opnsense/core, https://github.com/opnsense/core/blob/26.7.8/src/etc/inc/plugins.inc.d/ntpd.inc#L285-L312, https://github.com/opnsense/core/blob/26.7.8/src/www/services_ntpd_gps.php#L49

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    26.7.8
    26.7.7
    26.7.6
    26.7.5
    26.7.4
    26.7.3
    26.7.2
    26.7.1
    26.7
    26.7.r2
    26.7.r1
    26.7.r
    26.7.b
    26.7.a

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119560 | CVE-DB