OPNsense 23.7.9 → 26.1.5
58 releases · 0 breaking changes · 2 security fixes · 2 advisories fixed
2security0breaking0deprecated0feature0fix
Vulnerabilities fixed by this upgrade
- 6.3 CVE-2026-30868 OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state‑changing operations but are accessible via HTTP GET requests without CS…
- 9.1 CVE-2025-50989 OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php). The span POST parameter is concatenated into a s…
Breaking changes
None in the release notes.
Security changes
- security Fixes CVE-2026-30868: OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state‑changing operations but are accessible via HTTP GET requests without CS… in 26.1.4
- security Fixes CVE-2025-50989: OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php). The span POST parameter is concatenated into a s… in 25.1.8
Every release in between
securityFixes CVE-2026-30868: OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state‑changing operations but are accessible via HTTP GET requests without CS…
securityFixes CVE-2025-50989: OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php). The span POST parameter is concatenated into a s…