The vulnerability is an XPath injection flaw in the safe‑delete path of OPNsense’s API. Before the release of 26.1.11, the application interpolated a user‑provided token from the request URL directly into an XPath expression that scans config.xml, without first validating the token. An attacker who has any privilege for one of the 21 delete endpoints—such as those in Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, or Kea DHCP—can send a crafted token that causes the XPath evaluation to return configuration details. Because the request only triggers an error, the user cannot alter or delete configuration data, but the error response reveals item names, descriptions, reference paths, and UUIDs, effectively providing a substring presence oracle for configuration elements even in modules the user normally cannot view. This enables information disclosure of potentially sensitive deployment details.

The flaw affects the OPNsense firewall and routing platform version 26.1.10 and earlier of the core component. The vulnerable API endpoints are part of the core’s Configuration Management modules, including Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, and Kea DHCP, among a total of 21 delete operations. Only users with the corresponding module privilege can exploit the flaw, but the information leaked covers data across modules, including those outside the attacker’s normal scope.

The CVSS score of 4.3 indicates low severity, and the EPSS score below 1% shows a very low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog, further suggesting limited exploitation activity. The attack requires network access to the OPNsense API and possession of a module‑level privilege; it does not lead to configuration changes or remote code execution. The primary risk is confidentiality loss through disclosure of configuration metadata, which could aid further attacks. Defenses such as input validation, privilege checks, and updating to 26.1.11 mitigate the issue.