Messages

Confirmed fixed and closing the loop: updated to the official 2.12 release (hostapd 2.12_2, wpa_supplicant 2.12_1, both synced and unlocked now). WPA2 is enforced correctly on the AP — tested again via external scan and client connection, all good.

Thanks for the fast fix and for walking through the snapshot test — much appreciated!

Thanks Franco — I checked CVE-2026-58374 and I don't think it's related: that CVE is a DoS (crash) in the 802.11be/MLO association-request handling, gated behind CONFIG_IEEE80211BE, and only affects encryption negotiation. My AP isn't using Wi-Fi 7/MLO at all, so this CVE shouldn't touch WPA enforcement.

Hardware: PC Engines APU6, Wi-Fi card: Compex WLE200NX (Atheros AR928x-based, ath driver)

Here's what I can share to help pin down the regression:

interface=ath0_wlan2
driver=bsd
logger_syslog=-1
logger_syslog_level=0
logger_stdout=-1
logger_stdout_level=0
dump_file=/tmp/hostapd_ath0_wlan2.dump
ctrl_interface=/var/run/hostapd
ctrl_interface_group=wheel
#accept_mac_file=/tmp/hostapd_ath0_wlan2.accept
#deny_mac_file=/tmp/hostapd_ath0_wlan2.deny
#macaddr_acl=
ssid=XXXXXXXXXX
debug=
auth_algs=1
wpa=2
wpa_key_mgmt=WPA-PSK
wpa_pairwise=CCMP
wpa_group_rekey=60
wpa_gmk_rekey=3600
wpa_strict_rekey=
wpa_passphrase=XXXXXXXXXXXXXX

OPNsense GUI security mode configured: WPA2-PSK, unchanged across the upgrade

I reverted to hostapd/wpa_supplicant 2.11 via opnsense-revert -r 26.7.1 hostapd wpa_supplicant and the AP is back to enforcing WPA2 correctly, so this looks like a config-parsing or default-value change introduced in 2.12 that overrides or ignores the wpa=/wpa_key_mgmt= directives generated by OPNsense — rather than anything CVE-2026-58374-related. Possibly specific to the ath driver path, but I can't confirm without testing other chipsets.

Happy to test a patch or provide more logs if useful.

Titre : hostapd 2.12 (26.7.2) — AP broadcasts open/unprotected after upgrade (WPA security not applied)

Environment

OPNsense version: 26.7.2 (upgraded from 26.7.1_1)
Hardware: PC Engines APU6
Wi-Fi card: wle200nx
hostapd version before: 2.11 (working correctly)
hostapd version after upgrade: 2.12 (issue observed)

Description

After upgrading from 26.7.1_1 to 26.7.2, the Wi-Fi access point configured via hostapd on this system started broadcasting without any WPA/WPA2 protection — the SSID became open and unencrypted, despite the security configuration (WPA2-PSK) remaining unchanged in the GUI (Interfaces → Wireless).

Steps to reproduce

Configure a Wi-Fi interface as AP mode with WPA2-PSK security on 26.7.1_1.
Upgrade to 26.7.2 (bumps hostapd/wpa_supplicant from 2.11 to 2.12).
Observe that the AP is broadcasting open, with no encryption enforced.

Expected behavior

WPA2 security configured in the GUI should be preserved and enforced after the package upgrade.

Actual behavior

AP is open/unprotected, exposing the network to any nearby device without authentication.

Workaround

Reverted hostapd and wpa_supplicant to 2.11 via:

opnsense-revert -r 26.7.1 hostapd wpa_supplicant
pkg lock -y hostapd wpa_supplicant

This restored correct WPA2 enforcement.

Impact

This is a security-relevant regression — administrators upgrading to 26.7.2 with a Wi-Fi AP configured may be unknowingly exposing an open network.

Thank you Monviech, now I understand, I applied the patch and everything works again.

Ok, let's wait for the next update...

I confirm that in the current state it still does not work with APU2 and wle200nx in version 26.1.1

Hello,
After updating to 26.1, the wifi interfaces are still broken and impossible to recreate them (Firefox and EDGE)

For information, in pfSense with FreeBSD 14.0 and 15.0 I never had this problem, pfSense never used FreeBSD 14.1

Hi,
The same problem with an APU6.
The parameter kern.smp.disabled=1 solves the problem, but the APU only works on 1 core. so it's not the solution.

Setting the wifi channel to automatic solves the problem in my case.

Best regards
Cédric