The vulnerability is an XPath injection in the Trust module of OPNsense, allowing a user with CA Manager or Certificate Manager privileges to supply a crafted refid that is incorporated into untrusted XPath expressions. By repeatedly querying the object, the attacker can enumerate secret values from config.xml character by character, exposing password hashes, API credentials, certificate private keys, VPN key material and high‑availability secrets.

Affected systems are OPNsense firewall platforms using the opnsense:core package prior to version 26.1.10. The flaw resides in the CAsField and CertificatesField classes within the Trust module, which process certificate authority and certificate reference identifiers without proper sanitization.

The CVSS score of 7.1 reflects a medium to high impact for confidentiality and integrity, while an EPSS score of less than 1% indicates low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with elevated CA Manager or Certificate Manager rights, making it an internal threat with limited attack surface. If an attacker gains access to these privileged roles, the data disclosure can lead to full privilege escalation and compromise of additional security domains.