a new cve for freebsd wireguard was found :
https://www.freebsd.org/security/advisories/FreeBSD-SA-26:52.if_wg.asc
Greets!
https://www.tenable.com/cve/CVE-2026-58085 (https://www.tenable.com/cve/CVE-2026-58085)
CVSS v3 : Base Score: 7.5 (HIGH)
Its a big one!
(Failure to check inbound data authentication!)
Quick hotfix & backports would be very welcome. Very small patch, very big impact. Expect AI assisted exploit flood in 3...2...1 ...
It's a vulnerability that defeats the purpose of a VPN.
fixed, scheduled for 26.7.2 & 26.4.1p3
https://github.com/opnsense/src/pull/313
https://github.com/opnsense/core/issues/10650
Quote from: userfw on August 03, 2026, 12:08:51 PMIt's a vulnerability that defeats the purpose of a VPN.
To clear, this bug does only impact the data *authentication* check of the stream cipher on data inbound side - not the data *encryption* itself!
This bug does NOT leaked direct any information or allowed to manipulate any information without breaking the private / session key first.
This bug (or bug-door) allowed to trick the server to process (parse) unauthenticated data.
Thats bad! But to exploit this, at least some weeks ago, some nation-state-actor level know-how was needed.
With the now publicly accessible open weight ai models it's direct, one shot and reliable reproduce able, possible for *everyone* to directly identify this bug - including a detailed report about the complete implications further down the process chain ...
So, yes. Patch and back port. NOW!