How Does OPNsense CVE-2026-57155 Enable Root Access via GeoIP Imports?

A critical security flaw in OPNsense allows attackers to execute arbitrary commands with root privileges. The vulnerability, identified as CVE-2026-57155, affects versions of the FreeBSD-based firewall platform prior to 26.1.11. It resides in the GeoIP importer component, specifically within the process_zip and process_gzip code paths. This issue enables a user with Firewall Alias Edit permissions to write controlled content to the system as root.

How does the exploitation chain work?

The vulnerability stems from insufficient validation of CSV country_code values in the alias geoip.py script. According to the NVD record, an attacker can configure a malicious GeoIP source URL and supply an archive containing a crafted country code. This code traverses into an existing directory, allowing the system to write attacker-controlled files with -IPv4 or -IPv6 suffixes. These files are written below the /usr/local/share/GeoIP/alias directory with root privileges.

What leads to full system compromise?

Writing files as root is only the first stage of the attack. The source material indicates that attackers can combine this file write capability with a crafted newsyslog fragment. By also creating an oversized log file, the attacker can manipulate the default hourly root cron job. This mechanism allows the execution of arbitrary commands as root, resulting in complete compromise of the firewall. The National Vulnerability Database lists the weaknesses as CWE-22, CWE-73, and CWE-78.

Is a fix available for this issue?

Yes, the vendor has released a patch for this vulnerability. The issue is fixed in OPNsense version 26.1.11. Systems running any version prior to 26.1.11 are affected and remain vulnerable to this privilege escalation path. Administrators should verify their current version and apply the update to mitigate the risk of root compromise through the GeoIP importer.

What analysts watch for

Security teams usually monitor for unusual file creation events in directories typically managed by automated processes. Analysts should examine logs for unexpected writes to the GeoIP alias directory, particularly files with IPv4 or IPv6 suffixes that do not match standard naming conventions. Investigating cron job executions is also critical, as attackers often leverage scheduled tasks to maintain persistence or escalate privileges. Teams should check whether any user with alias editing rights has recently imported data from untrusted sources.

Background: Privilege escalation attacks

You leave systems open to privilege escalation by ignoring default accounts, misconfiguring file permissions, and failing to patch services. Fix these by applying least privilege, removing unnecessary services, and auditing user rights daily. These steps close the most common attack paths before an adversary gains control.

Read the full guide: 7 Privilege Escalation Mistakes That Leave Systems Exposed

What to do and how to stay safe: OPNsense

• Update OPNsense installations to version 26.1.11 or later to patch the path traversal vulnerability.
• Audit user permissions to ensure only trusted administrators have Firewall Alias Edit privileges.
• Monitor system logs for unauthorized file creations in the /usr/local/share/GeoIP/alias directory.
• Review cron job configurations for any unexpected or modified entries that could execute commands as root.

Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which OPNsense versions are affected by CVE-2026-57155?

All versions of OPNsense prior to 26.1.11 are affected by this critical vulnerability.

What privileges are required to exploit this flaw?

An attacker needs a user account with Firewall Alias Edit privilege to configure the malicious source.

How severe is this vulnerability?

The National Vulnerability Database rates CVE-2026-57155 as critical with a CVSS score of 9.9.