Topics

Hi all,

This is a small stable release addressing some of the upgrade related
issues that were reported last week as well as 4 new security advisories
for the core code.

Here are the full patch notes:

o system: add correct release name to boot splash screen for 26.7
o system: disable web GUI KTLS use for the time being
o system: do not let the components selectpicker grow indefinitely in defaults page
o system: DTLSv1.1 is forcefully rejected by OpenSSL 3.5, migrate to DTLSv1.2
o system: use Bootstrap "btn" styles in services widget
o system: use serialNumberHex for CRL so high-bit serials are not dropped (contributed by chrstnth)
o system: lower max-request-size to roughly max post size in lighttpd configs[1] (reported by lujiefsi)
o system: fixed several PHP 8.5 warnings
o firewall: use "urgent" as empty default for firewall debug messages
o firewall: skip message banner if searchPhrase set
o firewall: fix PHP warning when scrub yields no interfaces
o captive portal: automatic block rule should be evaluated after the anti-lockout rule
o openvpn: client export can export private keys for unlisted certificate references[2] (reported by iys8 and lujiefsi)
o backend: remove cache file on execution error in script_output
o mvc: fix tab/subtab form generation for plugins
o mvc: fix default labels in selectpickers
o mvc: form labels can be empty so make sure to add them to avoid warnings in forms
o mvc: safeguard some write operations with missing throwReadOnly() actions for custom action[3] (reported by lujiefsi)
o ui: fix multiple stored XSS[4] (reported by lujiefsi)
o plugins: os-theme-rebellion 1.9.5 (contributed by Team Rebellion)
o ports: ca_root_nss / nss 3.125[5]


Stay safe,
Your OPNsense team

--
[1] https://github.com/opnsense/core/security/advisories/GHSA-h4qj-j2x9-q553
[2] https://github.com/opnsense/core/security/advisories/GHSA-rw63-4hw9-p4v7
[3] https://github.com/opnsense/core/security/advisories/GHSA-vw8q-pqq7-2q7v
[4] https://github.com/opnsense/core/security/advisories/GHSA-jm2f-ch62-rpxr
[5] https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_125.html

What is up everyone,

For over 11 a half years now, OPNsense is driving innovation through
modularising and hardening the open source firewall, with simple
and reliable firmware upgrades, multi-language support, fast adoption
of upstream software updates, modern IPv6 support, as well as clear
and stable 2-Clause BSD licensing.

26.7, nicknamed "Xenial Xenops", features interface assignments and
gateway groups via MVC/API, firewall rules now defaulting to MVC/API,
outbound NAT to source NAT migration assistant, captive portal IPv6
support, Kea DDNS/custom options/dynamic prefix delegation, FreeBSD
15.1, OpenVPN 2.7, PHP 8.5, Python 3.13, plus much more.

The upgrade path for 26.1 will likely be unlocked later today.  We want
to ensure the upgrade goes as smoothly as possible so please be patient!  :)

Download links, an installation guide[1] and the checksums for the images
can be found below as well.

o Europe: https://opnsense.c0urier.net/releases/26.7/
o US East Coast: https://mirror.wdc1.us.leaseweb.net/opnsense/releases/26.7/
o US West Coast: https://mirror.sfo12.us.leaseweb.net/opnsense/releases/26.7/
o South America: http://mirror.ueb.edu.ec/opnsense/releases/26.7/
o East Asia: https://mirror.ntct.edu.tw/opnsense/releases/26.7/
o Full mirror list: https://opnsense.org/download/

Here are the full patch notes:

o system: remove periodic backups settings and backend code
o system: migrate gateway groups to MVC/API
o system: new service widget flat tile layout (partially contributed by Konstantinos Spartalis)
o system: make LDAP auth adhere to bad login penalty as well (contributed by Matt Andreko)
o system: move ldap_escape() to caller for now to avoid side effects
o system: improve the log_archive script to also work on log subdirectories
o system: change our version of "certctl" to emit files instead of links like it is the case in FreeBSD 15.1
o system: include interfaces widget in dashboard default
o system: adjust dashboard widget resize logic to observe border box instead of content box
o reporting: migrate several settings pages to MVC/API and assorted changes
o reporting: do not show disabled interfaces in traffic graphs (contributed by Konstantinos Spartalis)
o interfaces: migrate interface assignments to MVC/API
o interfaces: fix faulty netmask on loopback address due to upstream change
o firmware: remove overzealous cleansing in output_cmd to unhide individual character progress
o firewall: move config.xml default LAN allow rules to new rules GUI
o firewall: legacy rules pages move to plugin
o firewall: restrict automatic DHCPv6 filter rules to plugin/track6 use
o firewall: always set a sequence at the end of the rule set when cloning a NAT rule
o firewall: remove unused "safepoint" actions
o firewall: fix automatic source NAT rules not displayed for PPPoE interfaces
o firewall: flatten automatic source NAT rules into two per WAN type interface
o firewall: prevent deletion if a group is referenced in MVC rules
o firewall: constraint source NAT getAction() to only general page and align setAction() accordingly
o firewall: use proper path for one-to-one NAT rules for renaming operations
o firewall: avoid emitting reply-to on block rules as well
o firewall: change interface group render/apply order
o firewall: adjust MVC alias rename according to address_to_pconfig()
o firewall: adapt getAdvancedIds() to the sectioned form structure
o firewall: invalidate rule stats cache for firewall utilities API endpoint
o captive portal: move template actions out of the ServiceController into its own TemplateController
o captive portal: adjust accounting interval to Acct-Interim-Interval
o dnsmasq: possible use before define in lease watcher
o intrusion detection: rename "uncategorized" rule package to "adult" (contributed by Konstantinos Spartalis)
o monit: fix mail-format and poll-time validation
o unbound: missing NetMaskAllowed=N on override address
o wireguard: add allowed-ips to reresolve-dns.py in case none are set yet
o acl: merge user management ACLs into one single privilege
o backend: allow "strict" mode +TARGETS using the preamble "!"
o backend: swap "strict" template logic as it was reversed
o mvc: refactor base_dialog and parseFormNode() to simplify the template
o mvc: remove unused argument from getFormGrid()
o mvc: BaseField: emit descriptions in getNodes() when they are not the same as the value to match getNodeContent()
o mvc: PortField: reject whitespaces in port ranges during validation
o mvc: ModelRelationField: remove grouped option handling
o mvc: add file type to forms
o ui: add "opnsense-auto" theme which switches between "opnsense" and "opnsense-dark" depending on browser setting
o ui: decrease flashing in opnsense-auto theme when switching (contributed by Konstantinos Spartalis)
o ui: remove direct apply_btn_id usage in favour of base_apply_button template partial
o ui: fix menu registration not setting "active"
o plugins: os-firewall-legacy 1.0 contains the static PHP firewall rules pages
o plugins: os-ndproxy has been removed, use os-ndp-proxy-go instead
o src: FreeBSD 15.1-RELEASE-p1 plus assorted stable/15 networking commits[2]
o src: pf: do not mangle IP header before shared forwarding
o src: pf: stop resolving hosts via DNS that use ":" modifier
o src: pf: clear anchor after stepping into it in pf_match_translation_rule()
o src: pf: pf_route() "dst" no longer holds the gateway in 15.x
o ports: libevent 2.1.13[3]
o ports: lighttpd 1.4.85[4]
o ports: openvpn 2.7.5[5]
o ports: sqlite 3.53.3[6]
o ports: suricata 8.0.6[7]

Migration notes, known issues and limitations:

o The privileges "page-system-groupmanager" and "page-system-usermanager-addprivs" were merged into "page-system-groupmanager" and are no longer available separately.  This was done to avoid the misconception that access to a user management page gives constrained rights to each page, but that is not the case.  User management is a process involving all 3 pages.
o The static PHP pages for firewall rule management have been moved to the "os-firewall-legacy" plugin which can be manually installed before or after the upgrade.  All rules will continue to work regardless of the plugin being installed or not and are easily migrated using the given assistant.
o Hyper-V guests may be producing panics on certain hosts with more than one virtual processor assigned.  Make sure to snapshot beforehand and stay on 26.1.x until the situation is clear.
o Since this is a major OS upgrade and OpenSSL changes from 3.0 to 3.5 third party repositories may interfere with your upgrade experience.  Removing offending repositories and plugins may help; or wait for affirmation from the respective repository owners.
o The CPU microcode early loading has been known to be flaky on some setups.  A fix is in the FreeBSD 15.1 boot loader code, but can only be reached by reinstall or manually updating the boot code of your system after the upgrade succeeded.  If you want to be on the safe side during the upgrade itself please remove the plugin before proceeding.

The public key for the 26.7 series is:

-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAziSNKuzrL2cwLx5LXmLn
cWS5Lk+i9CzRMXO/4xQYBQCaSnd8GBg/HA/g4aPoTUa6ovAI0AHfW8KQJQyBkFzn
pi6MLZJ9tEaFcn0CiV+tSTJd1RV4bB8jtpKl5oTkgFrPsyaB7iBlG5Cd49VCW19h
DxClQ24lkWkVoYfsfCQEt4ADNGLygWCPyf4bxGD/t6/tiW9SsOs2+gfOZ9C/G2d/
EBhJFoBEoz5lvULVxTdfY5PScYrHD/waZnk3rGc2A+9pI/SM2JAwKqsgZ6MSFbXO
DNocSjqFUUkdqhty+Qcc0OJ+hMbKKVE+f3QJBQIwT3ayys8QK0m5CCo91/f+DjoN
noj+t5YN9x8GREkF0wrdIi7hevkwrL2/SJQbq1bL1BLB+mMSXYR611lgT8YfYjyZ
7tmpNVC3O5Pj7l20snm1lVUSqS0PsFBvh6HQtBRwQDGppaIIhH1Nt9yIatmSiGZt
2YrMVNBzbQrJzSX+vWcAulkaPIt4t+XxmpO5IDNZ+4uMZ7XyJq1lAhIeyXx+Falf
v7S+ZpJWFVNz0/N5z6lBbADD855i+gFY6B5209xGyhd6FwaPOjISgQKkgBwF1AiW
MDuTuP9lkh/U5gGBZIFTnbdEMgOAL4P+Hsw9Nozav+3QIpiU3Pv9F29a1erCkq09
rpQyNglY7Jqme/RipzbYia8CAwEAAQ==
-----END PUBLIC KEY-----


Stay safe,
Your OPNsense team


--
SHA256 (OPNsense-26.7-dvd-amd64.iso.bz2) = 95cafedda6d5b22ce832e249dc2309110fbee19f813ad78cf28bb3d387186bfb
SHA256 (OPNsense-26.7-nano-amd64.img.bz2) = 28d5e2f37e40d87468a924e3006ef10e2ddc6de485b85333d9e3958c84d0cb9d
SHA256 (OPNsense-26.7-serial-amd64.img.bz2) = 259b441646f1b0d77075a7281e368fe7f4c980360498ed6bc23740bd83c67e32
SHA256 (OPNsense-26.7-vga-amd64.img.bz2) = d975ed876e0650f6a5bf30b2e97218c5eaa370bef6597b19f43e22c1b950d3fc

[1] https://docs.opnsense.org/manual/install.html
[2] https://www.freebsd.org/releases/15.1R/relnotes/
[3] https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable
[4] https://www.lighttpd.net/2026/07/08/1.4.85/
[5] https://github.com/OpenVPN/openvpn/blob/v2.7.5/Changes.rst
[6] https://sqlite.org/releaselog/3_53_3.html
[7] https://forum.suricata.io/t/suricata-8-0-6-and-7-0-17-released/6391

What is up everyone,

Summer challenges aside: 26.7 is almost here!  It includes FreeBSD 15.1
and a somewhat small list of other highlights.  The reason for that is
a stringent backporting strategy that was employed in the 26.1 series.

Keep in mind this is an online-based pre-production test release.
Upgrades from the 26.1.11 development version are already available.
The final release date for 26.7 is July 15.

Here are the development highlights since version 26.1 came out:

o Interfaces assignments to MVC/API
o Gateway groups to MVC/API
o Firewall rules MVC page is now the default
o Source NAT is now a replacement for outbound NAT
o Captive portal IPv6 support
o Kea DDNS, custom options and dynamic prefix delegation support
o OpenVPN 2.7 with TLS-Crypt v2 support
o FreeBSD 15.1
o Python 3.13
o PHP 8.5

And these are the changes against version 26.7-RC1:

o system: include interfaces widget in dashboard default
o firewall: constraint source NAT getAction() to only general page and align setAction() accordingly
o firewall: use proper path for one-to-one NAT rules for renaming operations
o firewall: avoid emitting reply-to on block rules as well
o captive portal: adjust accounting interval to Acct-Interim-Interval
o firmware: remove overzealous cleansing in output_cmd to unhide individual character progress
o monit: fix mail-format and poll-time validation
o mvc: add file type to forms
o ports: suricata 8.0.6[1]


Stay safe,
Your OPNsense team

--
[1] https://forum.suricata.io/t/suricata-8-0-6-and-7-0-17-released/6391

Hi,

For the brave early testers the upgrade path is now live:

1. Switch to release type "development" and save.
2. Check for updates and install.
3. Check for updates again and it will offer 26.7.rc1 and install.
4. After upgrade switch back to release type "community" and save.
5. Check for updates and install 26.7.r1.

This will make the installed files match the published RC1 images.

A note of caution:

This is a major upgrade in the exact sense of the word: FreeBSD 15.1, PHP 8.5 and OpenSSL 3.5 are the components where we can be sure more problems are hiding somewhere, but we won't find out any other way.  If you have third party repository or plugin installed proceed with caution: we do not vet upgrades of them and they are likely not ready to make the jump.  Removing them beforehand is likely the best course of action at the moment.


Cheers,
Franco

What is up everyone,

Summer challenges aside: 26.7 is almost here!  It includes FreeBSD 15.1
and a somewhat small list of other highlights.  The reason for that is
a stringent backporting strategy that was employed in the 26.1 series.

Keep in mind this is mostly an image-based pre-production test release.
Upgrades from the 26.1.11 development version will be available later
this week.  An online-only RC2 will probably follow as well.  The final
release date for 26.7 is July 15.

https://pkg.opnsense.org/releases/26.7/

Here are the development highlights since version 26.1 came out:

o Interfaces assignments to MVC/API
o Gateway groups to MVC/API
o Firewall rules MVC page is now the default
o Source NAT is now a replacement for outbound NAT
o Captive portal IPv6 support
o Kea DDNS, custom options and dynamic prefix delegation support
o OpenVPN 2.7 with TLS-Crypt v2 support
o FreeBSD 15.1
o Python 3.13
o PHP 8.5

And these are the changes against version 26.1.11:

o system: remove periodic backups settings and backend code
o system: migrate gateway groups to MVC/API
o system: new service widget flat tile layout (partially contributed by Konstantinos Spartalis)
o system: make LDAP auth adhere to bad login penalty as well (contributed by Matt Andreko)
o system: move ldap_escape() to caller for now to avoid side effects
o system: improve the log_archive script to also work on log subdirectories
o system: change our version of "certctl" to emit files instead of links like it is the case in FreeBSD 15.1
o reporting: migrate several settings pages to MVC/API and assorted changes
o interfaces: migrate interface assignments to MVC/API
o firewall: move config.xml default LAN allow rules to new rules GUI
o firewall: legacy rules pages move to plugin
o firewall: restrict automatic DHCPv6 filter rules to plugin/track6 use
o firewall: always set a sequence at the end of the rule set when cloning a NAT rule
o firewall: remove unused "safepoint" actions
o firewall: fix automatic source NAT rules not displayed for PPPoE interfaces
o firewall: flatten automatic source NAT rules into two per WAN type interface
o firewall: prevent deletion if a group is referenced in MVC rules
o captive portal: move template actions out of the ServiceController into its own TemplateController
o dnsmasq: possible use before define in lease watcher
o intrusion detection: rename "uncategorized" rule package to "adult" (contributed by Konstantinos Spartalis)
o unbound: missing NetMaskAllowed=N on override address
o wireguard: add allowed-ips to reresolve-dns.py in case none are set yet
o acl: merge user management ACLs into one single privilege
o backend: allow "strict" mode +TARGETS using the preamble "!"
o mvc: refactor base_dialog and parseFormNode() to simplify the template
o mvc: remove unused argument from getFormGrid()
o mvc: BaseField: emit descriptions in getNodes() when they are not the same as the value to match getNodeContent()
o mvc: PortField: reject whitespaces in port ranges during validation
o mvc: ModelRelationField: remove grouped option handling
o ui: add "opnsense-auto" theme which switches between "opnsense" and "opnsense-dark" depending on browser setting
o ui: decrease flashing in opnsense-auto theme when switching (contributed by Konstantinos Spartalis)
o ui: remove direct apply_btn_id usage in favour of base_apply_button template partial
o ui: fix menu registration not setting "active"
o plugins: os-firewall-legacy 1.0 contains the static PHP firewall rules pages
o plugins: os-ndproxy has been removed, use os-ndp-proxy-go instead
o src: FreeBSD 15.1-RELEASE-p1 plus assorted stable/15 networking commits[1]
o ports: libevent 2.1.13[2]
o ports: openvpn 2.7.5[3]
o ports: sqlite 3.53.3[4]

Migration notes, known issues and limitations:

o The privileges "page-system-groupmanager" and "page-system-usermanager-addprivs" were merged into "page-system-groupmanager" and are no longer available separately.  This was done to avoid the misconception that access to a user management page gives constrained rights to each page, but that is not the case.  User management is a process involving all 3 pages.
o The static PHP pages for firewall rule management have been moved to the "os-firewall-legacy" plugin that can be optionally installed.  Note that the upgrade will not install it as rules will continue to work and are easily migrated using the given assistant.

The public key for the 26.7 series is:

-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAziSNKuzrL2cwLx5LXmLn
cWS5Lk+i9CzRMXO/4xQYBQCaSnd8GBg/HA/g4aPoTUa6ovAI0AHfW8KQJQyBkFzn
pi6MLZJ9tEaFcn0CiV+tSTJd1RV4bB8jtpKl5oTkgFrPsyaB7iBlG5Cd49VCW19h
DxClQ24lkWkVoYfsfCQEt4ADNGLygWCPyf4bxGD/t6/tiW9SsOs2+gfOZ9C/G2d/
EBhJFoBEoz5lvULVxTdfY5PScYrHD/waZnk3rGc2A+9pI/SM2JAwKqsgZ6MSFbXO
DNocSjqFUUkdqhty+Qcc0OJ+hMbKKVE+f3QJBQIwT3ayys8QK0m5CCo91/f+DjoN
noj+t5YN9x8GREkF0wrdIi7hevkwrL2/SJQbq1bL1BLB+mMSXYR611lgT8YfYjyZ
7tmpNVC3O5Pj7l20snm1lVUSqS0PsFBvh6HQtBRwQDGppaIIhH1Nt9yIatmSiGZt
2YrMVNBzbQrJzSX+vWcAulkaPIt4t+XxmpO5IDNZ+4uMZ7XyJq1lAhIeyXx+Falf
v7S+ZpJWFVNz0/N5z6lBbADD855i+gFY6B5209xGyhd6FwaPOjISgQKkgBwF1AiW
MDuTuP9lkh/U5gGBZIFTnbdEMgOAL4P+Hsw9Nozav+3QIpiU3Pv9F29a1erCkq09
rpQyNglY7Jqme/RipzbYia8CAwEAAQ==
-----END PUBLIC KEY-----

Please let us know about your experience!


Stay safe,
Your OPNsense team

--
SHA256 (OPNsense-26.7.r1-dvd-amd64.iso.bz2) = 6b8430921316bd1d912a7bf71d02f2e354cd82b644c3fbf2646ab55382b9a758
SHA256 (OPNsense-26.7.r1-nano-amd64.img.bz2) = 1b95ab4cafaa195272b2b9d7ac3f42015c277b918818f535851c8c3206c5829d
SHA256 (OPNsense-26.7.r1-serial-amd64.img.bz2) = 0db5557508f088e513436f6f7ad5c37f42c6614ce50a34595523890cded7c336
SHA256 (OPNsense-26.7.r1-vga-amd64.img.bz2) = 2e352fd8628e742dd0637a8f84768f607b3ad45a4491a77d9623b4976ac6931b

[1] https://www.freebsd.org/releases/15.1R/relnotes/
[2] https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable
[3] https://github.com/OpenVPN/openvpn/blob/v2.7.5/Changes.rst
[4] https://sqlite.org/releaselog/3_53_3.html

Hi again,

Back already with a bag of security advisories also for FreeBSD which came out
just yesterday.  We highly appreciate the increased amount of reports we are
getting for the core code and we are working through them, but need to improve
our process and guidelines somewhat in order to make more sense of the result
for all of you.  This will probably take additional effort after 26.7 is out.

Note that this update brings the outbound to source NAT migration page, but it
is only a formality as outbound NAT will stay in 26.7 although the legacy
firewall rules page will move to a plugin during the major upgrade.  It is the
same process that was employed with ISC-DHCP.  Due to this addition, however,
the source NAT rules entered in the system will no longer work unless the
mode is set to either "manual" or "hybrid".

And thanks everyone for early 26.7-BETA testing!  We are content to ship
26.7-RC1 early next week as a follow-up.  The final release of 26.7 is
planned for July 15.

Here are the full patch notes:

o system: configuration line injection via multiple GUI text fields[1] (reported by lujiefsi)
o system: add missing legacy_html_escape_form_data() for $a_cert on administration settings[2] (reported by Jonas Ampferl of Hacking Cult)
o system: lockout: address newline injection and correct IP parsing[3] (reported by lujiefsi)
o system: add "local_uri" type in SanitizeFilter() and use it to avoid hardcoding
o system: several compatible adjustments for upcoming PHP 8.5
o system: fix ACL pattern for carp_status action (contributed by Etienne Girault)
o system: enhance live log widget (contributed by Greelan)
o firewall: safeguard ISO country codes in alias download[4] (reported by Jonas Ampferl of Hacking Cult)
o firewall: escape user-controlled values in tooltip attributes[5] (reported by Jonas Ampferl of Hacking Cult)
o firewall: add the same new rules GUI design to the MVC NAT pages
o firewall: add CSV download/upload to MVC NAT pages
o firewall: add migration for outbound NAT into source NAT page
o firewall: destination NAT: display effective port when local-port is omitted
o firewall: source NAT: allow empty target which means the interface address
o firewall: source NAT: skip rendering rules when mode is not advanced/manual or hybrid
o firewall: improve performance on MVC pages using virtualDOM
o firewall: allow WAN as "associated interface" for NPTv6 when prefix ID is set
o firewall: fix TypeError on alias getItem() with unknown UUID (contributed by haxorton)
o firewall: unify group names of OpenVPN, WireGuard and IPsec encapsulation
o firewall: show rule counts that can be exported and hide tab if no rules exist
o firewall: improve interface filter logic to include floating rules with multiple interfaces when they overlap with at least one interface in the interface filter request
o firewall: add validations for "No RDR" option to prevent target and local-port being set
o firewall: skip alias on new rules GUI apply
o interfaces: prohibit the use of advanced DHCP option settings by non-administrators
o interfaces: properly format API times to ISO format and convert timezone for display in automatic discovery
o captive portal: pass in ip_address as a set for accounting
o firmware: fix small glitch that re-prompts for showing community plugins
o kea: add widget to show DHCP leases
o kea: simplify model option values
o monit: use throwNotFullAdmin() to restrict monit GUI write access to full admins due to intended system wide execution rights
o network time: fix stored XSS in GPS init string display[6] (reported by Jonas Ampferl of Hacking Cult)
o openvpn: prevent path traversal in "common_name" attribute[7] (reported by lujiefsi)
o openvpn: escape client common_name in connection-status views[8] (reported by Jan Kahmen of turningpoint and lujiefsi)
o openvpn: simplify model option values
o mvc: checkAndThrowValueInUse validate input token which may only contain alphanum and dashes[9] (reported by Jonas Ampferl of Hacking Cult)
o mvc: guard BaseField::setNodes() against a list given for a scalar leaf (contributed by haxorton)
o mvc: DescriptionField: disable special and newline characters
o mvc: FileObject: fix exception bug (contributed by Greelan)
o mvc: also do not translate empty labels in grids
o mvc: give throwReadOnly() a sibling named throwNotFullAdmin()
o mvc: use camelCase for carp_status action
o ui: bootgrid: minor optimizations
o ui: add generic escaping function htmlSafe() for JavaScript
o plugins: os-cloudflared 1.1[10]
o plugins: os-freeradius 1.10.2[11]
o plugins: os-vnstat 1.4[12]
o src: vm: use-after-free in device pager page list[13]
o src: execve: local privilege escalation via execve(2) TOCTOU race[14]
o src: openzfs: multiple vulnerabilities in OpenZFS[15]
o src: libalias: bffer overflow in libalias RTSP handler[16]
o src: unlinkat: unlinkat(2) ignores AT_RESOLVE_BENEATH flag[17]
o src: tcp: use-after-free in TCP RACK stack option handler[18]
o src: posixshm: multiple vulnerabilities in POSIX largepage objects[19]
o src: audit: incorrect audit records for ptrace(2) syscall requests[20]
o src: ktls: remote DOS via uninitialized memory access in KTLS receive[21]
o src: linux: kernel stack disclosure in Linux compatibility layer[22]
o src: iconf: multiple vulnerabilities in iconv(3)[23]
o ports: curl 8.21.0[24]
o ports: expat 2.8.2[25]
o ports: ldns 1.9.2[26]
o ports: lighttpd 1.4.84[27]
o ports: phalcon 5.16.0[28]
o ports: py-duckdb 1.5.4[29]
o ports: syslog-ng 4.12.0[30]


Stay safe,
Your OPNsense team

--
[1] https://www.cve.org/cverecord?id=CVE-2026-57154 
[2] https://www.cve.org/cverecord?id=CVE-2026-58394
[3] https://www.cve.org/cverecord?id=CVE-2026-57155
[4] https://www.cve.org/cverecord?id=CVE-2026-58394
[5] https://github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv
[6] https://www.cve.org/cverecord?id=CVE-2026-58392
[7] https://www.cve.org/cverecord?id=CVE-2026-58393
[8] https://www.cve.org/cverecord?id=CVE-2026-58390
[9] https://www.cve.org/cverecord?id=CVE-2026-58395
[10] https://github.com/opnsense/plugins/blob/stable/26.1/net/cloudflared/pkg-descr
[11] https://github.com/opnsense/plugins/blob/stable/26.1/net/freeradius/pkg-descr
[12] https://github.com/opnsense/plugins/blob/stable/26.1/net/vnstat/pkg-descr
[13] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:37.vm.asc
[14] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:39.execve.asc
[15] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:40.zfs.asc
[16] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:41.libalias.asc
[17] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:42.unlinkat.asc
[18] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:43.tcp.asc
[19] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:44.posixshm.asc
[20] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:45.audit.asc
[21] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:46.ktls.asc
[22] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:47.linux.asc
[23] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:49.iconv.asc
[24] https://curl.se/changes.html#8_21_0
[25] https://github.com/libexpat/libexpat/blob/R_2_8_2/expat/Changes
[26] https://github.com/NLnetLabs/ldns/blob/1.9.2/Changelog
[27] https://www.lighttpd.net/2026/06/17/1.4.84/
[28] https://github.com/phalcon/cphalcon/releases/tag/v5.16.0
[29] https://github.com/duckdb/duckdb/releases/tag/v1.5.4
[30] https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.12.0

Hi everyone,
 
We are very happy to announce that we are partnering with Nordian to cater to growing hardware demand and ensure that software development will continue at its usual pace. This comes at an inflection point where the goals we pursued and met in the last decade shall be replaced by new, even more ambitious goals.
 
Camiel Dobbelaar is also joining Nordian in this investment. He is a strong supporter of open source and has a track record of contributions to pf and OpenBSD from way back. We believe that we have all the ingredients to continue and grow OPNsense together with the community.
 
The European idea is at the heart of what we do: hardware and software made in Europe -- fit to deliver the same high standards of safety, security, and sustainability that benefit users worldwide. Time and effort went into obtaining LINCE certification and we do believe it was worth it. Now we are looking forward to improving OPNsense further in this general direction and thus providing better network protection for anyone who is willing to give us a chance in the years to come.
 
 
Stay safe,
Franco on behalf of the OPNsense team

[1] https://nordian.nl/en/nordian-partners-with-deciso

Hi all,

Behind the scenes we were working on providing the first images for the upcoming 26.7 series. We aligned with the FreeBSD 15.1 release schedule and fixed all the installer compatibilities we've found. From early testing FreeBSD 15.1 behaves pretty well. The main difference from current community versions is PHP 8.5, OpenSSL 3.5 and that this image is only containing the development version. Upgrades to future versions are possible.

For now there's no path to upgrade from an existing 26.1.x but manual instructions can be shared once 26.1.11 is released next week. 26.7-RC1 will also add the stable release path.

You can find the usual images here:

https://pkg.opnsense.org/FreeBSD:15:amd64/snapshots/misc/26.7.b/

SHA256 (OPNsense-devel-26.7.b-dvd-amd64.iso.bz2) = 73fb138ae4ea0f2eccb1f7966a88f78d863a012f15b314105a5533f74b27abad
SHA256 (OPNsense-devel-26.7.b-nano-amd64.img.bz2) = 79c881c87af8fe27eef4d5a94cb7d211296870dc5fcfc00bc409c62fbdaa441f
SHA256 (OPNsense-devel-26.7.b-serial-amd64.img.bz2) = d7f257c7360c840e9d16360ef973cb6ca6b0b9ee10f761751d471ed92f16a0d7
SHA256 (OPNsense-devel-26.7.b-vga-amd64.img.bz2) = 62622a0a1a9954f77edde657fc8c66115977cd115737f475ec53aecc2b97117c

The public key for 26.7 is as follows:

-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAziSNKuzrL2cwLx5LXmLn
cWS5Lk+i9CzRMXO/4xQYBQCaSnd8GBg/HA/g4aPoTUa6ovAI0AHfW8KQJQyBkFzn
pi6MLZJ9tEaFcn0CiV+tSTJd1RV4bB8jtpKl5oTkgFrPsyaB7iBlG5Cd49VCW19h
DxClQ24lkWkVoYfsfCQEt4ADNGLygWCPyf4bxGD/t6/tiW9SsOs2+gfOZ9C/G2d/
EBhJFoBEoz5lvULVxTdfY5PScYrHD/waZnk3rGc2A+9pI/SM2JAwKqsgZ6MSFbXO
DNocSjqFUUkdqhty+Qcc0OJ+hMbKKVE+f3QJBQIwT3ayys8QK0m5CCo91/f+DjoN
noj+t5YN9x8GREkF0wrdIi7hevkwrL2/SJQbq1bL1BLB+mMSXYR611lgT8YfYjyZ
7tmpNVC3O5Pj7l20snm1lVUSqS0PsFBvh6HQtBRwQDGppaIIhH1Nt9yIatmSiGZt
2YrMVNBzbQrJzSX+vWcAulkaPIt4t+XxmpO5IDNZ+4uMZ7XyJq1lAhIeyXx+Falf
v7S+ZpJWFVNz0/N5z6lBbADD855i+gFY6B5209xGyhd6FwaPOjISgQKkgBwF1AiW
MDuTuP9lkh/U5gGBZIFTnbdEMgOAL4P+Hsw9Nozav+3QIpiU3Pv9F29a1erCkq09
rpQyNglY7Jqme/RipzbYia8CAwEAAQ==
-----END PUBLIC KEY-----


The roadmap has a few more insights on what to expect: https://opnsense.org/roadmap/


Cheers,
Franco

This business release is based on the OPNsense 26.1.9 community version
with additional reliability improvements.

Here are the full patch notes for the initial release:

o system: refactor dashboard to use User model instead of direct config access
o system: throw UserException when dashboard size limit was reached on save
o system: add notes dashboard widget (contributed by Konstantinos Spartalis)
o system: fix traffic dashboard widget initialization race condition (contributed by Greelan)
o system: avoid side effect rendering sysctl item in config.xml during console assignment
o system: improve cron command and parameter escaping
o system: support RADIUS NAS-IP-Address attribute for authentication
o system: add compatibility layer to future route disable/enable migration
o system: only split first colon when reading sysctls
o system: revisit snapshot name validation (partially contributed by Konstantinos Spartalis)
o system: fix missing newline when generating cron jobs due to a regression
o system: fix missing base64_decode() in JsonField which prevented user settings from saving
o system: link CA references after all changes
o system: parse certificate "key_type" and "digest"
o system: allow flushing legacy OpenVPN legacy config
o system: audit "staticroute" config access
o system: use safe config iteration in core_user_changed_groups()
o system: tighten landing page redirect (contributed by Konstantinos Spartalis)
o system: fix passing null into getRealInterface()
o system: fix regression in selective group delete introduced previously
o system: allow unregistered plugin cron actions to be deleted
o system: disable MAILTO for cron jobs
o system: dashboard: explicitly compact on layout shift if there is no predefined layout
o system: dashboard: update result on default restore
o reporting: render NaN values as empty values and omit leading empty records from data set for health graphs
o reporting: add max on Y axis for traffic graphs
o interfaces: refactor bridge reconfigure script
o interfaces: add missing config locks in device controllers
o interfaces: use safe iteration in backend code
o interfaces: adjust and annotate interface_dhcpv6_id()
o interfaces: account for multiple UUIDs in VIP deletion
o interfaces: more safe iteration through config_read_array()
o interfaces: fix wrong DUID-UUID format but keep accepting the wrong one
o interfaces: fix regression in selective device delete introduced previously
o interfaces: IAID selection and prefix range reservation for WAN DHCPv6
o interfaces: parse ifconfig output despite exit error in legacy_interfaces_details()
o interfaces: hostwatch: pin warning banner to enabled flag
o firewall: live view: decode HTML where necessary to aid filtering
o firewall: use save method from ApiMutableModelControllerBase for log command, move rule command and savepoint action
o firewall: safe config access in list_legacy_rules.php
o firewall: remove duplicated CSV button hook
o firewall: fix NPTv6 validation for empty external subnet
o firewall: make getRealInterface() a static utility function
o firewall: refactor searchRuleAction() to use the same filtering and sorting logic on MVC and legacy data
o firewall: fix inverted source/destination cosmetic issue in SNAT and One-to-One NAT grids
o firewall: fix search for floating rules in new rules GUI
o firewall: add an alias formatter to show content fields as "dynamic" when populated by other components
o firewall: fix Tabulator regression with alias batch delete
o firewall: use safe config iteration in interface registration
o firewall: fix unintended change in filtering logic for new rules GUI
o firewall: fix action, ipprotocol and protocol translations for legacy rules in new rules GUI
o firewall: use safe iteration over rules in filter_core_rules_user()
o firewall: add missing exclamation mark for "not" in scrub rules
o firewall: fix interface sorting by value for live log and groups
o firewall: add banner if no rules defined in new rules GUI to match legacy GUI
o firewall: use strnatcasecmp() for interface list in new rules GUI
o firewall: fix typo that prevented queues to be selectable in pf-based traffic shaping
o firewall: escape shaper targets in rule edit[1] (contributed by lujiefsi)
o captive portal: remove redirection on HTTPS and ditch non-functional pass statement
o dnsmasq: change DHCP tag to DescriptionField
o dnsmasq: change widget link from settings to leases page
o firmware: opnsense-bootstrap: add "-B" bare bootstrap mode
o firmware: add repo configuration output to connectivity audit
o firmware: stop buffering in sed to fix chunked update log output
o firmware: retain ordering in update servers for connectivity check
o firmware: allow "local" business mirror subscription
o firmware: put clickable trailer for community plugins
o firmware: fix return value masking during updates
o firmware: opnsense-update: do not clean obsolete files on manual -r invokes
o intrusion detection: fix drop and alert buttons on rules tab
o ipsec: move swanctl.conf download button to the tab
o ipsec: restyle the connections page for clarity
o ipsec: disable scroll in authentication and children grids (contributed by Konstantinos Spartalis)
o ipsec: validate the use of refid in CA certificates[2] (reported by lujiefsi)
o kea: fix "Delegated length must be longer than or equal to prefix length" validation
o kea: add ddns-override-no-update, ddns-override-client-update and ddns-update-on-renew per subnet
o kea: DDNS DNS server port can now be specified
o kea: add explicit reverse DDNS zones support (contributed by XtraLarge)
o kea: add DDNS manual config override
o kea: remove depend constraint of ddns_reverse_zone
o kea: plug socket into dynamic PD route installation script
o kea: add prefix to reservations to allow for static PD allocations based on DUID/MAC
o kea: infer IPv6 lease type in delete script via lease lookup so IA_NA/IA_PD can be deleted
o kea: DDNS add ddns-conflict-resolution-mode per subnet (contributed by chaispaquichui)
o kea: allow customizing "mac_sources" and change default to "ipv6-link-local"
o kea: add user-context object to config to emit description
o kea: fix option_data_autocollect mismatch in DHCPv6 page
o kea: enable internalModelSafeDelete due to increased model relation field usage
o kea: build reservation status from control socket output
o kea: add subnet vltime (partially contributed by Brandan Giles)
o kea: add client-id to DHCPv4 reservations
o kea: use JSON_UNESCAPED_UNICODE when writing the JSON configuration
o kea: dynamic prefix delegation support[3]
o kea: always start the prefix watcher when DHCPv6 is enabled
o kea: cleanups for IntegerField using isSet() and no negative numbers allowed
o kea: add decline_probation_period and set lower default to mitigate faulty client implementations to consume the whole pool
o kea: add subnet allocator field (contributed by Marcos Della)
o kea: add DHCPv4 compatibility options (contributed by Marcos Della)
o kea: hook up reservation.next_server (contributed by Ian Munsie)
o kea: fix missing visual cues for manual mode in DDNS and DHCPv4/6
o network time: small cleanups in ntpd_configure_gps()
o openvpn: add tls-crypt-v2 support
o openvpn: allow restart action via cron
o openvpn: fix client export not showing common names
o openvpn: require an integer of at least 1 for "vpnid" field
o radvd: allow user controlled hop limit (contributed by BPplays)
o radvd: allow to start a manual configuration without primary IPv6
o unbound: improve hostname/domain override validation
o unbound: minor style/refactor for safe config access
o unbound: hide unused tree row in form output for overrides
o unbound: restyle statistics page
o unbound: blocklists categorization and apply button message update (contributed by Konstantinos Spartalis)
o wireguard: use getValues() consistently in control script
o acl: some missing references and using camelCase pointers instead of snake_case
o backend: configctl: properly quote parameters to avoid skipping empty ones (contributed by Majx)
o backend: configctl: support -f cache flush parameter to fix cache invalidation preamble "!" pass
o lang: numerous updates and fixes in existing languages
o mvc: introduce JSON field type and refactor dashboard to use it
o mvc: fixed a number of class import statements
o mvc: remove unused UIModelGrid imports in IDS, Monit and Syslog controllers
o mvc: remove Util imports where not needed
o mvc: BaseField: add count() helper
o mvc: fix validation to use getValue instead of plain string cast
o mvc: UIModelGrid: remove flatten() method as getFlatNodes() is almost the same
o mvc: add support for pluggable dynamic menu items and move some existing parts out of the MenuSystem class
o mvc: stricter email address validation
o mvc: OptionsField: use key as value if no value is set
o mvc: unify migration message returns
o mvc: add new validators to TextField: AllowSpaces, AllowNewlines, AllowSpecial and introduce new StrictTextField
o mvc: strict alphanumeric-only regex for certificate refid[4] (contributed by eev4n)
o mvc: simplify assorted option values to reduce duplication
o mvc: static header support for forms
o rc: move system_powerd_configure() to bootup plugin hook
o shell: config access refactor in password and setaddr scripts
o shell: safe iteration for VLAN/LAGG in port assignment
o shell: use safe config iteration in live mode banner
o shell: fix syntax error in port assignment
o ui: generalize placeholders between controllers and JS
o ui: simplify and clean up debounce() usage
o ui: trap generic error popup for specific API URLs such as /api/core/firmware/upgradestatus when it adds no value and known to be unstable
o ui: add static dialog header support and fix bool/string compare
o ui: add type_formatter keyword to form rendering
o ui: add save/cancel button support to form rendering
o ui: remove "event" use from bootgrid showSaveAlert()
o ui: add support for binary file uploads
o ui: bootgrid: onRendered executed in wrong spot
o ui: clean up useRequestHandlerOnGet usage
o ui: use space in apply box for the apply reminder
o ui: improve form validation error append
o ui: tab exclusion for SimpleActionButton
o ui: split form button row render as some forms only use save
o ui: override selectpicker defaults for translations
o ui: hide apply button for specific tabs on multiple pages (contributed by Konstantinos Spartalis)
o ui: bootgrid: align datakey with the rest of the options, but allow top-level placement
o ui: bootgrid: mark state variables as such
o ui: bootgrid: safeguard replace() function
o ui: bootgrid: remove unused getTotalRowCount() method
o ui: bootgrid: prevent NaN pagination values for non-ajax grids when row count is set to all
o ui: bootgrid: clean up converter compatibility code
o ui: bootgrid: replace "append" with "replace" for ajax: false grids
o ui: bootgrid: adjust column persistence behavior to prevent horizontal dead space
o ui: bootgrid: allow column selection exclusions
o ui: allow passing of data attributes for select items in setFormData()
o ui: remove banner on inline reload if applicable
o ui: button padding when injecting next to apply button
o ui: fix spurious padding in apply button section (contributed by Konstantinos Spartalis)
o plugins: os-cloudflared 1.0 (contributed by Richard Aspden)
o plugins: os-ddclient 1.31[5]
o plugins: os-frr 1.53[6]
o plugins: os-netbird 1.3[7]
o plugins: os-q-feeds-connector 1.6[8]
o plugins: os-rfc2136 1.10[9]
o plugins: os-stunnel fix for missing include in script
o plugins: os-telegraf 1.12.15[10]
o plugins: os-tinc fixes evaluation of hosts enabled flag (contributed by Konstantinos Spartalis)
o plugins: os-turnserver 1.3[11]
o plugins: os-zabbix-agent 1.9[12]
o plugins: os-zabbix-proxy 1.7[13]
o plugins: use safe config iteration in interface registration code
o src: missing permission check in thr_kill2[14]
o src: arbitrary file overwrite via the KTLS receive path[15]
o src: multiple vulnerabilities in the sound mmap path[16]
o src: sigqueue missing capability mode restriction[17]
o src: use-after-free bug in the IPV6_MSFILTER socket option handler[18]
o src: flaw in Linuxulator execution of setugid binaries[19]
o src: ASLR bypass for setuid executables via procctl[20]
o src: integer overflow in vt CONS_HISTORY ioctl[21]
o src: openssl: fix multiple vulnerabilities[22]
o src: ldns: fix query response validation[23]
o src: netlink: fix lock leak in nl_find_nhop
o src: pf: avoid taking the pf rules write lock in a couple of ioctls
o src: ipfw: add ability to run ipfw binary with 15.0+ kernel module
o src: ipfw: treat ipv6 address with zero mask as "any"
o ports: curl 8.20.0[24]
o ports: dnsmasq 2.93[25]
o ports: filterlog 0.8 changes rule label fetch to libpfctl
o ports: kea 3.0.3[26]
o ports: krb5 1.22.2[27]
o ports: libxml 2.15.3[28]
o ports: nss 3.124[29]
o ports: openssh 10.3p1[30]
o ports: openssl 3.0.21[31]
o ports: openvpn 2.7.4[32]
o ports: phalcon 5.14.2[33]
o ports: php 8.3.31[34]
o ports: phpseclib 3.0.55[35]
o ports: py-duckdb 1.5.3[36]
o ports: py-numpy 2.4.6
o ports: py-requests 2.33.1
o ports: python 3.13.14[37]
o ports: sqlite3 3.53.1[38]
o ports: strongswan 6.0.7[39]

--
[1] https://github.com/opnsense/core/security/advisories/GHSA-m4m3-v627-wgc2
[2] https://github.com/opnsense/core/security/advisories/GHSA-33q4-wcv7-r8fr
[3] https://docs.opnsense.org/manual/kea.html
[4] https://www.cve.org/cverecord?id=CVE-2026-53582
[5] https://github.com/opnsense/plugins/blob/stable/26.1/dns/ddclient/pkg-descr
[6] https://github.com/opnsense/plugins/blob/stable/26.1/net/frr/pkg-descr
[7] https://github.com/opnsense/plugins/blob/stable/26.1/security/netbird/pkg-descr
[8] https://github.com/opnsense/plugins/blob/stable/26.1/security/q-feeds-connector/pkg-descr
[9] https://github.com/opnsense/plugins/blob/stable/26.1/dns/rfc2136/pkg-descr
[10] https://github.com/opnsense/plugins/blob/stable/26.1/net-mgmt/telegraf/pkg-descr
[11] https://github.com/opnsense/plugins/blob/stable/26.1/net/turnserver/pkg-descr
[12] https://github.com/opnsense/plugins/blob/stable/26.1/net-mgmt/zabbix-agent/pkg-descr
[13] https://github.com/opnsense/plugins/blob/stable/26.1/net-mgmt/zabbix-proxy/pkg-descr
[14] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:25.thr.asc
[15] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:26.ktls.asc
[16] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:27.sound.asc
[17] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:28.capsicum.asc
[18] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:29.ip6_multicast.asc
[19] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:30.linux.asc
[20] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:32.elf.asc
[21] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:34.vt.asc
[22] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:35.openssl.asc
[23] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:36.ldns.asc
[24] https://curl.se/changes.html#8_20_0
[25] https://www.thekelleys.org.uk/dnsmasq/CHANGELOG
[26] https://gitlab.isc.org/isc-projects/kea/-/wikis/Release-Notes/release-notes-3.0.3
[27] https://web.mit.edu/kerberos/krb5-1.22/
[28] https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.15.3/NEWS
[29] https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_124.html
[30] https://www.openssh.com/txt/release-10.3
[31] https://github.com/openssl/openssl/blob/openssl-3.0/CHANGES.md
[32] https://github.com/OpenVPN/openvpn/blob/v2.7.4/Changes.rst
[33] https://github.com/phalcon/cphalcon/releases/tag/v5.14.2
[34] https://www.php.net/ChangeLog-8.php#8.3.31
[35] https://github.com/phpseclib/phpseclib/releases/tag/3.0.55
[36] https://github.com/duckdb/duckdb/releases/tag/v1.5.3
[37] https://docs.python.org/release/3.13.14/whatsnew/changelog.html
[38] https://sqlite.org/releaselog/3_53_1.html
[39] https://github.com/strongswan/strongswan/releases/tag/6.0.7

A fine day to you all,

This update is the obvious answer to recent reports throughout the ecosystem:
There are 3 core security issues fixed, FreeBSD security advisories, third
party updates as well as assorted fixes plus improvements in the new rules GUI.

The firmware page had a number of minor regressions that should be sorted out
with this release.  They did not affect updates, but made the process a bit
less smooth than usual.  Be assured that each minor update is tested quite
extensively, but non-functional issues like these can always slip through a
test cycle and will be found in the next one.  In the worst case that means
two stable releases: the issues appeared with 26.1.8 but were not visible
before 26.1.9 was being tested.

Under the hood the preparation for Source NAT migration, MVC/API support
for interface assignments and FreeBSD 15.1 support is underway.  We expect
a 26.7-BETA in the near future once we are satisfied with the overall quality.

Here are the full patch notes:

o system: routing: changed "disable" option to "enable"
o system: dashboard: explicitly compact on layout shift if there is no predefined layout
o system: dashboard: update result on default restore
o interfaces: parse ifconfig output despite exit error in legacy_interfaces_details()
o interfaces: hostwatch: pin warning banner to enabled flag
o firewall: always show automatic and legacy rules in new rules GUI
o firewall: add banner if no rules defined in new rules GUI to match legacy GUI
o firewall: use strnatcasecmp() for interface list in new rules GUI
o firewall: fix typo that prevented queues to be selectable in pf-based traffic shaping
o firewall: escape shaper targets in rule edit[1] (contributed by lujiefsi)
o dnsmasq: change widget link from settings to leases page
o firmware: stop buffering in sed to fix chunked update log output
o firmware: retain ordering in update servers for connectivity check
o firmware: allow "local" business mirror subscription
o firmware: put clickable trailer for community plugins
o firmware: fix return value masking during updates
o firmware: opnsense-update: do not clean obsolete files on manual -r invokes
o intrusion detection: fix drop and alert buttons on rules tab
o ipsec: disable scroll in authentication and children grids (contributed by Konstantinos Spartalis)
o ipsec: validate the use of refid in CA certificates[2] (reported by lujiefsi)
o kea: prevent converting the decimal prefix_id using hexdec() for dynamic PD
o openvpn: fix client export not showing common names
o openvpn: require an integer of at least 1 for "vpnid" field
o mvc: add new validators to TextField: AllowSpaces, AllowNewlines, AllowSpecial and introduce new StrictTextField
o mvc: strict alphanumeric-only regex for certificate refid[3] (contributed by eev4n)
o mvc: simplify assorted option values to reduce duplication
o mvc: static header support for forms
o rc: move system_powerd_configure() to bootup plugin hook
o ui: bootgrid: allow column selection exclusions
o ui: allow passing of data attributes for select items in setFormData()
o ui: remove banner on inline reload if applicable
o ui: button padding when injecting next to apply button
o ui: fix spurious padding in apply button section (contributed by Konstantinos Spartalis)
o plugins: os-cloudflared 1.0 (contributed by Richard Aspden)
o plugins: os-frr 1.53[4]
o plugins: os-rfc2136 1.10[5]
o plugins: os-stunnel fix for missing include in script
o plugins: os-telegraf 1.12.15[6]
o src: missing permission check in thr_kill2[7]
o src: arbitrary file overwrite via the KTLS receive path[8]
o src: multiple vulnerabilities in the sound mmap path[9]
o src: sigqueue missing capability mode restriction[10]
o src: use-after-free bug in the IPV6_MSFILTER socket option handler[11]
o src: flaw in Linuxulator execution of setugid binaries[12]
o src: ASLR bypass for setuid executables via procctl[13]
o src: integer overflow in vt CONS_HISTORY ioctl[14]
o src: openssl: fix multiple vulnerabilities[15]
o src: ldns: fix query response validation[16]
o src: netlink: fix lock leak in nl_find_nhop
o src: pf: avoid taking the pf rules write lock in a couple of ioctls
o src: ipfw: add ability to run ipfw binary with 15.0+ kernel module
o src: ipfw: treat ipv6 address with zero mask as "any"
o ports: dnsmasq 2.93[17]
o ports: filterlog 0.8 changes rule label fetch to libpfctl
o ports: openssl 3.0.21[18]
o ports: phalcon 5.14.2[19]
o ports: phpseclib 3.0.55[20]
o ports: py-duckdb 1.5.3[21]
o ports: py-numpy 2.4.6
o ports: python 3.13.14[22]
o ports: sqlite3 3.53.1[23]
o ports: strongswan 6.0.7[24]


Stay safe,
Your OPNsense team

--
[1] https://github.com/opnsense/core/security/advisories/GHSA-m4m3-v627-wgc2
[2] https://github.com/opnsense/core/security/advisories/GHSA-33q4-wcv7-r8fr
[3] https://www.cve.org/cverecord?id=CVE-2026-53582
[4] https://github.com/opnsense/plugins/blob/stable/26.1/net/frr/pkg-descr
[5] https://github.com/opnsense/plugins/blob/stable/26.1/dns/rfc2136/pkg-descr
[6] https://github.com/opnsense/plugins/blob/stable/26.1/net-mgmt/telegraf/pkg-descr
[7] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:25.thr.asc
[8] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:26.ktls.asc
[9] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:27.sound.asc
[10] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:28.capsicum.asc
[11] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:29.ip6_multicast.asc
[12] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:30.linux.asc
[13] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:32.elf.asc
[14] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:34.vt.asc
[15] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:35.openssl.asc
[16] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:36.ldns.asc
[17] https://www.thekelleys.org.uk/dnsmasq/CHANGELOG
[18] https://github.com/openssl/openssl/blob/openssl-3.0/CHANGES.md
[19] https://github.com/phalcon/cphalcon/releases/tag/v5.14.2
[20] https://github.com/phpseclib/phpseclib/releases/tag/3.0.55
[21] https://github.com/duckdb/duckdb/releases/tag/v1.5.3
[22] https://docs.python.org/release/3.13.14/whatsnew/changelog.html
[23] https://sqlite.org/releaselog/3_53_1.html
[24] https://github.com/strongswan/strongswan/releases/tag/6.0.7

Hello again,

As a sign of the times this update ships 3 core security fixes as well
as OS and third party updates.  Kea dynamic prefix delegation is also
included plus more GUI improvements.

Time to 26.7 is short.  See you soon!  :)

Here are the full patch notes:

o system remove unused data-tooltip that is not properly escaped from certificates widget[1]
o system: tighten landing page redirect (contributed by Konstantinos Spartalis)
o system: fix passing null into getRealInterface()
o system: fix regression in selective group delete introduced previously
o system: allow unregistered plugin cron actions to be deleted
o system: disable MAILTO for cron jobs
o reporting: render NaN values as empty values and omit leading empty records from data set for health graphs
o reporting: add max on Y axis for traffic graphs
o interfaces: dhclient.conf does not cope with multi-line request/require
o interfaces: account for multiple UUIDs in VIP deletion
o interfaces: more safe iteration through config_read_array()
o interfaces: fix wrong DUID-UUID format but keep accepting the wrong one
o interfaces: fix regression in selective device delete introduced previously
o interfaces: IAID selection and prefix range reservation for WAN DHCPv6
o firewall: fix for missing HTML escape in description render in legacy rules GUI[2]
o firewall: add an alias formatter to show content fields as "dynamic" when populated by other components
o firewall: fix Tabulator regression with alias batch delete
o firewall: use safe config iteration in interface registration
o firewall: fix unintended change in filtering logic for new rules GUI
o firewall: fix action, ipprotocol and protocol translations for legacy rules in new rules GUI
o firewall: use safe iteration over rules in filter_core_rules_user()
o firewall: add missing exclamation mark for "not" in scrub rules
o firewall: fix interface sorting by value for live log and groups
o captive portal: remove redirection on HTTPS and ditch non-functional pass statement
o dnsmasq: change DHCP tag to DescriptionField
o ipsec: move swanctl.conf download button to the tab
o ipsec: restyle the connections page for clarity
o kea: dynamic prefix delegation support[3]
o kea: always start the prefix watcher when DHCPv6 is enabled
o kea: cleanups for IntegerField using isSet() and no negative numbers allowed
o kea: add decline_probation_period and set lower default to mitigate faulty client implementations to consume the whole pool
o kea: add subnet allocator field (contributed by Marcos Della)
o kea: add DHCPv4 compatibility options (contributed by Marcos Della)
o kea: hook up reservation.next_server (contributed by Ian Munsie)
o kea: fix missing visual cues for manual mode in DDNS and DHCPv4/6
o monit: sanitize monit output before offering it
o network time: cleanse port option before use[4] (reported by Konstantinos Spartalis)
o network time: small cleanups in ntpd_configure_gps()
o unbound: blocklists categorization and apply button message update (contributed by Konstantinos Spartalis)
o acl: some missing references and using camelCase pointers instead of snake_case
o mvc: add support for pluggable dynamic menu items and move some existing parts out of the MenuSystem class
o mvc: stricter email address validation
o mvc: OptionsField: use key as value if no value is set
o mvc: unify migration message returns
o mvc: do not translate empty strings
o ui: clean up useRequestHandlerOnGet usage
o ui: use space in apply box for the apply reminder
o ui: improve form validation error append
o ui: tab exclusion for SimpleActionButton
o ui: split form button row render as some forms only use save
o ui: override selectpicker defaults for translations
o ui: hide apply button for specific tabs on multiple pages (contributed by Konstantinos Spartalis)
o ui: bootgrid: align datakey with the rest of the options, but allow top-level placement
o ui: bootgrid: mark state variables as such
o ui: bootgrid: safeguard replace() function
o ui: bootgrid: remove unused getTotalRowCount() method
o ui: bootgrid: prevent NaN pagination values for non-ajax grids when row count is set to all
o ui: bootgrid: clean up converter compatibility code
o ui: bootgrid: replace "append" with "replace" for ajax: false grids
o ui: bootgrid: adjust column persistence behavior to prevent horizontal dead space
o plugins: use safe config iteration in interface registration code
o plugins: os-tinc fixes evaluation of hosts enabled flag (contributed by Konstantinos Spartalis)
o src: dhclient: improve server and filename validation[5]
o src: setcred: fix buffer overflow[6]
o src: kern: make sure to drain selinfo sleepers[7]
o src: fusefs: handle buggy server LISTXATTR response[8]
o src: ptrace: fix validation of PT_SC_REMOTE arguments[9]
o src: libcasper: switch from select(2) to poll(2)[10]
o src: cap_net: do not allow new limits to drop keys from the old ones[11]
o src: ipfw: fix parsing error in nat config port_range
o src: ipfw: fix checksum after NAT
o src: igmp: Avoid leaving dangling pointers in the state-change queue
o src: vxlan: Update *m0 after a pullup
o src: routing: use a better error number in sysctl_fibs()
o src: routing: initialize V_rt_numfibs earlier during boot
o src: pfsync: reject invalid SCTP states
o src: pf: do not reject rules with colliding hashes
o src: rtnetlink: check for allocation failure in nlattr_get_multipath()
o src: rtnetlink: align RTA_MULTIPATH length validation in nlattr_get
o ports: nss 3.124[12]
o ports: openvpn 2.7.4[13]
o ports: php 8.3.31[14]
o ports: py-numpy 2.4.4
o ports: suricata 8.0.5[15]
o ports: unbound 1.25.1[16]


Stay safe,
Your OPNsense team

--
[1] https://www.cve.org/cverecord?id=CVE-2026-49132
[2] https://www.cve.org/cverecord?id=CVE-2026-49131
[3] https://docs.opnsense.org/manual/kea.html
[4] https://github.com/opnsense/core/security/advisories/GHSA-872g-g543-j37m
[5] https://www.freebsd.org/security/advisories/FreeBSD-EN-26:11.dhclient.asc
[6] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:18.setcred.asc
[7] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:19.file.asc
[8] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:20.fusefs.asc
[9] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:21.ptrace.asc
[10] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:22.libcasper.asc
[11] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:24.cap_net.asc
[12] https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_124.html
[13] https://github.com/OpenVPN/openvpn/blob/v2.7.4/Changes.rst
[14] https://www.php.net/ChangeLog-8.php#8.3.31
[15] https://suricata.io/2026/05/19/suricata-8-0-5-and-7-0-16-released/
[16] https://nlnetlabs.nl/projects/unbound/download/#unbound-1-25-1

Hi there,

This updated fixes two recently reported vulnerabilities in the core code
pertaining to WAN DHCPv4 configuration and user management.  It also includes
third party updates to Dnsmasq, OpenSSH and Unbound amongst others.

Captive portal IPFW accounting rules will regain a performance boost by
bringing back hash lookups.  Since this update does not issue a reboot
by itself either do so or restart the captive portal instances to activate
this change.

Here are the full patch notes:

o system: properly escape username in sync_user.php command invoke[1] (contributed by Konstantinos Spartalis)
o system: fix XMLRPC sync with VIP and "nosync" option
o system: link CA references after all changes
o system: parse certificate "key_type" and "digest"
o system: allow flushing legacy OpenVPN legacy config
o system: audit "staticroute" config access
o system: use safe config iteration in core_user_changed_groups()
o interfaces: safeguard DHCPv4 settings against arbitrary command injection[2] (reported by Kchigo)
o interfaces: add missing config locks in device controllers
o interfaces: use safe iteration in backend code
o interfaces: adjust and annotate interface_dhcpv6_id()
o firewall: use save method from ApiMutableModelControllerBase for log command, move rule command and savepoint action
o firewall: safe config access in list_legacy_rules.php
o firewall: remove duplicated CSV button hook
o firewall: fix NPTv6 validation for empty external subnet
o firewall: make getRealInterface() a static utility function
o firewall: refactor searchRuleAction() to use the same filtering and sorting logic on MVC and legacy data
o firewall: fix inverted source/destination cosmetic issue in SNAT and One-to-One NAT grids
o captive portal: re-introduce hash lookup for accounting purposes
o captive portal: reload IPFW on captive portal reconfigure too
o dnsmasq: ignore DHCP names for "wpad" to fix CERT Vulnerability VU#598349
o firmware: opnsense-bootstrap: add "-B" bare bootstrap mode
o firmware: add repo configuration output to connectivity audit
o kea: plug socket into dynamic PD route installation script
o kea: add prefix to reservations to allow for static PD allocations based on DUID/MAC
o kea: infer IPv6 lease type in delete script via lease lookup so IA_NA/IA_PD can be deleted
o kea: DDNS add ddns-conflict-resolution-mode per subnet (contributed by chaispaquichui)
o kea: allow customizing "mac_sources" and change default to "ipv6-link-local"
o kea: add user-context object to config to emit description
o kea: fix option_data_autocollect mismatch in DHCPv6 page
o kea: enable internalModelSafeDelete due to increased model relation field usage
o kea: build reservation status from control socket output
o kea: add subnet vltime (partially contributed by Brandan Giles)
o kea: add client-id to DHCPv4 reservations
o network time: fix ACL definitions (contributed by Konstantinos Spartalis)
o openvpn: reload configuration for group sync after successful authentication
o openvpn: add tls-crypt-v2 support
o openvpn: allow restart action via cron
o radvd: allow to start a manual configuration without primary IPv6
o unbound: minor style/refactor for safe config access
o unbound: hide unused tree row in form output for overrides
o unbound: restyle statistics page
o wireguard: use getValues() consistently in control script
o mvc: remove unused UIModelGrid imports in IDS, Monit and Syslog controllers
o mvc: remove Util imports where not needed
o mvc: BaseField: add count() helper
o mvc: fix validation to use getValue instead of plain string cast
o mvc: UIModelGrid: remove flatten() method as getFlatNodes() is almost the same
o shell: safe iteration for VLAN/LAGG in port assignment
o shell: use safe config iteration in live mode banner
o ui: add static dialog header support and fix bool/string compare
o ui: add type_formatter keyword to form rendering
o ui: add save/cancel button support to form rendering
o ui: remove "event" use from bootgrid showSaveAlert()
o ui: add support for binary file uploads
o plugins: os-ddclient 1.31[3]
o plugins: os-frr 1.52[4]
o plugins: os-netbird 1.3[5]
o plugins: os-q-feeds-connector 1.6[6]
o plugins: os-turnserver 1.3[7]
o ports: curl 8.20.0[8]
o ports: dnsmasq 2.92rel2[9]
o ports: expat 2.8.1[10]
o ports: kea 3.0.3[11]
o ports: krb5 1.22.2[12]
o ports: libxml 2.15.3[13]
o ports: nss 3.123.1[14]
o ports: openssh 10.3p1[15]
o ports: phalcon 5.12.1[16]
o ports: py-duckdb 1.5.2[17]
o ports: py-requests 2.33.1
o ports: unbound 1.25.0[18]


Stay safe,
Your OPNsense team

--
[1] https://www.cve.org/cverecord?id=CVE-2026-44194
[2] https://www.cve.org/cverecord?id=CVE-2026-45158
[3] https://github.com/opnsense/plugins/blob/stable/26.1/dns/ddclient/pkg-descr
[4] https://github.com/opnsense/plugins/blob/stable/26.1/net/frr/pkg-descr
[5] https://github.com/opnsense/plugins/blob/stable/26.1/security/netbird/pkg-descr
[6] https://github.com/opnsense/plugins/blob/stable/26.1/security/q-feeds-connector/pkg-descr
[7] https://github.com/opnsense/plugins/blob/stable/26.1/net/turnserver/pkg-descr
[8] https://curl.se/changes.html#8_20_0
[9] https://www.thekelleys.org.uk/dnsmasq/CHANGELOG
[10] https://github.com/libexpat/libexpat/blob/R_2_8_1/expat/Changes
[11] https://gitlab.isc.org/isc-projects/kea/-/wikis/Release-Notes/release-notes-3.0.3
[12] https://web.mit.edu/kerberos/krb5-1.22/
[13] https://gitlab.gnome.org/GNOME/libxml2/-/blob/master/NEWS
[14] https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_123_1.html
[15] https://www.openssh.com/txt/release-10.3
[16] https://github.com/phalcon/cphalcon/releases/tag/v5.12.1
[17] https://github.com/duckdb/duckdb/releases/tag/v1.5.2
[18] https://nlnetlabs.nl/projects/unbound/download/#unbound-1-25-0

That was quick!

This includes all very recent FreeBSD SA/EN patches, a number of system
improvements (how are you doing, Kea!) and third party updates for OpenVPN
and StrongSwan.

It also includes one high and one medium advisory for our code.  GitHub
has not issued a CVE for this yet, unfortunately, but this announcement
will be updated as soon as that happens.  See below for details.

Here are the full patch notes:

o system: protect popen() with exec_safe()[1]
o system: lockout bypass fix[2] (contributed by Konstantinos Spartalis)
o system: refactor dashboard to use User model instead of direct config access
o system: throw UserException when dashboard size limit was reached on save
o system: add notes dashboard widget (contributed by Konstantinos Spartalis)
o system: allow gateway load balance weights from 1 to 10 for more flexibility (contributed by Matthew Hall)
o system: fix traffic dashboard widget initialization race condition (contributed by Greelan)
o system: avoid side effect rendering sysctl item in config.xml during console assignment
o system: improve cron command and parameter escaping
o system: add "nosync" option to gateway configuration
o system: support RADIUS NAS-IP-Address attribute for authentication
o system: add compatibility layer to future route disable/enable migration
o system: only split first colon when reading sysctls
o system: revisit snapshot name validation (partially contributed by Konstantinos Spartalis)
o interfaces: refactor bridge reconfigure script
o firewall: live view: decode HTML where necessary to aid filtering
o firewall: fix typo in alias update error log and make parser a bit more resilient
o firmware: opnsense-update: handle FreeBSD.conf disable internally
o kea: fix "Delegated length must be longer than or equal to prefix length" validation
o kea: add ddns-override-no-update, ddns-override-client-update and ddns-update-on-renew per subnet
o kea: DDNS DNS server port can now be specified
o kea: add explicit reverse DDNS zones support (contributed by XtraLarge)
o kea: add DDNS manual config override
o kea: remove depend constraint of ddns_reverse_zone
o radvd: allow user controlled hop limit (contributed by BPplays)
o unbound: improve hostname/domain override validation
o backend: configctl: properly quote parameters to avoid skipping empty ones (contributed by Majx)
o lang: numerous updates and fixes in existing languages
o mvc: introduce JSON field type and refactor dashboard to use it
o mvc: fixed a number of class import statements
o shell: config access refactor in password and setaddr scripts
o ui: generalize placeholders between controllers and JS
o ui: simplify and clean up debounce() usage
o ui: trap generic error popup for specific API URLs such as /api/core/firmware/upgradestatus when it adds no value and known to be unstable
o plugins: os-acme-client 4.16[3]
o plugins: os-zabbix-agent 1.9[4]
o plugins: os-zabbix-proxy 1.7[5]
o src: vm_fault: reset m_needs_zeroing properly[6]
o src: timerfd: Fix interval callout scheduling[7]
o src: tty: avoid leaving dangling pointers in tty_drop_ctty()[8]
o src: pkru: fix handling of 1GB largepage mappings[9]
o src: contrib/tzdata: import tzdata 2025c, 2026a and 2026b[10]
o src: amd64: fix INVLPGB range invalidation[11]
o src: pf: improve SCTP validation[12]
o src: execve: fix an operator precedence bug[13]
o src: dhclient: check for unexpected characters in some DHCP server options[14]
o src: dhclient: fix reallocation of dhclient script environments[15]
o src: libnv: switch fd_wait() from select(2) to poll(2)[16]
o src: libnv: fix heap overflow in nvlist_recv()[17]
o src: libpcap: update to 1.10.6
o src: ipfw_nptv6: fix handling the ifaddr removal event
o src: if_tuntap: make SIOCIFDESTROY interruptible
o src: pfctl: parser must not ignore error from pfctl_optimize_ruleset()
o src: pf: fix duplicate rule detection for automatic tables
o src: openssl: update from 3.0.16 to 3.0.20
o src: routing: fix use-after-free in finalize_nhop
o src: ixgbe: fix MRQC register value
o src: in_mcast: Fix a lock leak in inp_set_source_filters()
o src: linuxkpi: fix an off-by-one error in the kfifo implementation
o src: sctp: fix so_proto when peeling off a socket
o ports: expat 2.8.0[18]
o ports: openvpn 2.6.20[19]
o ports: phpseclib 3.0.52[20]
o ports: strongswan 6.0.6[21]


Stay safe,
Your OPNsense team

--
[1] https://www.cve.org/cverecord?id=CVE-2026-44193
[2] https://www.cve.org/cverecord?id=CVE-2026-44195
[3] https://github.com/opnsense/plugins/blob/stable/26.1/security/acme-client/pkg-descr
[4] https://github.com/opnsense/plugins/blob/stable/26.1/net-mgmt/zabbix-agent/pkg-descr
[5] https://github.com/opnsense/plugins/blob/stable/26.1/net-mgmt/zabbix-proxy/pkg-descr
[6] https://www.freebsd.org/security/advisories/FreeBSD-EN-26:05.vm.asc
[7] https://www.freebsd.org/security/advisories/FreeBSD-EN-26:06.timerfd.asc
[8] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:10.tty.asc
[9] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:11.amd64.asc
[10] https://www.freebsd.org/security/advisories/FreeBSD-EN-26:09.tzdata.asc
[11] https://www.freebsd.org/security/advisories/FreeBSD-EN-26:10.amd64.asc
[12] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:14.pf.asc
[13] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:13.exec.asc
[14] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:12.dhclient.asc
[15] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:15.dhclient.asc
[16] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:16.libnv.asc
[17] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:17.libnv.asc
[18] https://github.com/libexpat/libexpat/blob/R_2_8_0/expat/Changes
[19] https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn26#Changesin2.6.20
[20] https://github.com/phpseclib/phpseclib/releases/tag/3.0.52
[21] https://github.com/strongswan/strongswan/releases/tag/6.0.6

The OPNsense business edition transitions to this 26.4 release including
full MVC/API experience as automation rules have been promoted to the new
rules GUI, Suricata with a new inline inspection mode using "divert",
assorted IPv6 reliability and feature improvements, router advertisements
MVC/API, full code shell command escaping revamp, default IPv6 mode now
using Dnsmsaq for client connectivity, Unbound blocklist source selection,
an automatic host discovery service, captive portal IPv6 support plus much
more.

Please make sure to read the migration notes before upgrading.

Download link is as follows.  An installation guide[1] and the checksums for
the images can be found below as well.

https://downloads.opnsense.com/

This business release is based on the OPNsense 26.1.6 community version
with additional reliability improvements.

Here are the full patch notes:

o system: factory reset and console tools now default to using Dnsmasq for DHCP
o system: wizard now offers an abort button and deployment type selections
o system: wizard can disable WAN or LAN interface now
o system: provide resolv.conf overrides via /etc/resolv.conf.local
o system: add XMLRPC option for hostwatch
o system: remove "upstream" from gateway grid as priority already reflects the proper data
o system: adjust gateway group priority (tier) wording
o system: add note field to store comments for each snapshot
o system: add configurable "memberOf" attribute to LDAP connector
o system: do not scrub unrelated IPv6 DHCP ranges from Dnsmasq LAN config during wizard
o system: adapt DHCP address shell setup for new config access functions
o system: adapt web GUI certificate renew for new config access function
o system: adapt initial port configuration DHCP setting for new config access functions
o system: avoid using "(system)" user revision annotation to match legacy and MVC code
o system: fix log files 'go to page' edge case and row count persistence/max
o system: ignore future backups when they exist to ensure new backups are saved
o system: ensure proper types are emitted in searchGatewayAction() when configd action fails
o system: use safe iteration for cert/ca in system_trust_configure()
o system: fixed broken link in modal header when using HA and saving administration settings
o system: create a backup on factory reset
o system: unify pwd_changed_at usage
o system: store dashboard layout types based on column breakpoints
o system: do not show snapshot notes in the grid
o system: use safe config iteration in admin settings page
o system: cleanup and simplify certificate deployment and remove legacy config import
o system: validate monitor uniqueness based on the host route presence
o system: simplify user/group sync scripts using config_read_array()
o system: dashboard gauge improvements (contributed by Konstantinos Spartalis)
o system: compress height of the log viewer grid
o reporting: restore canvas state in health graph to fix Firefox display bug
o reporting: use safe config iteration in RRD code
o interfaces: a new IPv6 mode called "Identity association" was added
o interfaces: add and enable new host discovery feature for neighbours via hostwatch
o interfaces: settings page was migrated to MVC/API
o interfaces: handle hostwatch user/group via package
o interfaces: force-reload IPv6 connectivity when PDINFO changes during renew
o interfaces: dhcp6c rapid-commit, request-dns and config write refactoring
o interfaces: generalise the rtsold_script code
o interfaces: use descriptive interface names in automatic discovery table
o interfaces: harden settings page with file_safe() and allowed_classes=false
o interfaces: host discovery: make sure the full dump includes NDP output on fallback
o interfaces: fix migration for IPv6 no-release option
o interfaces: fix wlanmode argument usage
o interfaces: generalise the dhcp6c_script using the new IFNAME variable
o interfaces: fix enter key in assignment description and general cleanup
o interfaces: protect device reads against forcing empty arrays into $config
o interfaces: remove unused ip_in_interface_alias_subnet()
o interfaces: use safe config iteration in PPP edit page
o interfaces: clean up overview UI code and fix CARP badge alignment
o interfaces: simplify CARP scripts using config_read_array()
o interfaces: automatic dhclient recovery
o interfaces: settings page use cases for config_read_array()
o interfaces: configurable cleanups for automatic neighbor discovery via hostwatch
o interfaces: refactor PPP CARP hook
o firewall: escape selector in rule_protocol
o firewall: "Port forward" was migrated to "Destination NAT" MVC/API
o firewall: unified look and feel of MVC/API pages formerly known as "automation"
o firewall: improved support of gateway groups in policy-based routing
o firewall: plugin support for "ether" rules has been removed
o firewall: add import/export to shaper queues and pipes
o firewall: "divert-to" support in new rules GUI
o firewall: added a rule migration page (use with care)
o firewall: make previously associated DNAT rules editable
o firewall: FilterBaseController requires Base\UserException
o firewall: fix typo with sprintf() with DNAT rule
o firewall: fix target mapping inconsistency leading to references not being processed in destination NAT
o firewall: use local-port as target when specified in destination NAT
o firewall: fix missing reply-to when not specifically set in new rules
o firewall: live view: fix parsing of combined filters stored as converted strings
o firewall: fix group rename in source_net, destination_net and SNAT/DNAT target fields
o firewall: add tcpflags_any in new rules GUI for parity with legacy rules
o firewall: exclude loopback from interface selectpicker in new rules GUI
o firewall: well known ports added to filter rule selection
o firewall: undefined is also "*" in new rules grid
o firewall: add download button for validation errors in rule import
o firewall: allow TTL usage on host entries
o firewall: add missing implementation for "disablereplyto" in new rules
o firewall: fix encoding issue in dashboard widget
o firewall: check for schedules in use in new rules
o firewall: add import/export function and missing lock on set action
o firewall: better focus selected alias updates to in crease performance when either --aliases or --types is used
o firewall: implement missing ICMP types in new rules GUI (contributed by Bjoern Jakobsen)
o firewall: adjust for parseReplace() for icmp-type "skip"
o firewall: fix NAT rule enabled checks display (contributed by Aaron Rogers)
o firewall: prevent separator char from being used in category names
o firewall: fix running into error using well known protocols with "-" in them
o firewall: add validation to prevent using both gateway and reply-to in the same rule in new GUI
o firewall: add a command button to open the live log with pre-filled rule ID in new GUI
o firewall: move download and upload commands out of partial into global commands in new GUI
o firewall: reduce complexity in URL hash handling and when using firewall_rule_lookup.php in new GUI
o firewall: fix default ipprotocol mismatch so that when not specified both are indicated
o firewall: update destination NAT ACL to match our menu entry
o firewall: fix issues with searching in the states page
o firewall: allow well known ports in local-port destination NAT
o firewall: adjust row selection behaviour for internal rules in MVC pages
o firewall: offer aliases the same was as the field type expects them
o firewall: fix access to deleted filter node in advanced settings
o firewall: merge MVC NAT page templates into a single one
o firewall: when repopulating the interface selectpicker, always restore current selection in new rules GUI
o firewall: remove hardcoded colors where possible in new rules GUI
o firewall: fix category colors in new rules GUI
o firewall: merge read of groups and interfaces in new rules GUI
o firewall: make MVC protocol selection match the old rules pages
o firewall: add model validations for common errors in destination NAT
o firewall: live view: allow regex use in "contains" cases
o firewall: live view: fix SyntaxWarning in log reader backend
o firewall: use safe iteration in old rule page for schedule lookup
o firewall: use safe config iteration in outbound NAT page
o firewall: fix regression in alias summary not shown in new rules GUI
o firewall: invalidate database when last updated time is in the future
o firewall: add missing "static port" option in source NAT
o firewall: add semantic groups coloring option in dashboard widget (contributed by Gunnar Lieb)
o firewall: add missing alias rename rule targets
o firewall: add alias GeoIP database update button and move bogons one to the same tab
o firewall: fix port handling in registered NAT rule
o firewall: fix MVC code vs. legacy rules display issues
o firewall: outbound NAT page use case for config_read_array()
o firewall: fix wrong "pass" on DNAT rule when using register rule
o firewall: adjust sort order in networks and aliases in new rules GUI
o firewall: change sorting to interface/group name and stop caring about counted rules in new rules GUI
o firewall: change category sorting using names instead of counted rules in new rules GUI
o firewall: remove tokenizer from categories and use selectpicker instead in new rules GUI
o captive portal: cleanup and simplify certificate deployment and remove legacy config import
o captive portal: enforce POST-only on logoffAction() (contributed by Oliver Jueguen)
o captive portal: add IPv6 support (partially contributed by Alex Goodkind)
o captive portal: fix allowed addresses missing from session IPs in roaming case
o dhcrelay: relax the check for present addresses and CARP-related cleanups
o dnsmasq: add automatic RDNSS option when none is configured
o dnsmasq: fix log conditions
o dnsmasq: add IP address validations for some of the DHCPv4 and DHCPv6 options (contributed by Greelan)
o dnsmasq: add "no-ping" option (contributed by Konstantinos Spartalis)
o dnsmasq: remove a too-strict validation for suffix IPv6 addresses without constructor use
o dnsmasq: ensure the lease view handles client-id correctly
o dnsmasq: prevent "*" from being collected as "client_id"
o firmware: opnsense-code: run configure script on upgrade if needed
o firmware: revoke 25.7 fingerprint
o firmware: fix automatic advanced toggle in settings
o firmware: shorten the reboot message to fit the spinner on the same line
o firmware: tweaks for update/upgrade cleanup behaviours between core and opnsense-update
o firmware: add support for aux repository handling in opnsense-update
o firmware: add aux repository support
o firmware: repeat the update after pkg reinstall
o installer: ufs: ignore errors when flushing the full disk
o intrusion detection: add a "divert" intrusion prevention mode
o intrusion detection: upgrade ET Open ruleset to version 8.0 (contributed by 0nnyx)
o ipsec: expose ChaCha20-Poly1305 AEAD proposals in IKEv2 (contributed by Kota Shiratsuka)
o ipsec: use safe config iteration for VIP lookup
o ipsec: add 4 insecure proposals for compatibility (contributed by Bjoern Jakobsen)
o kea: add libdhcp_host_cmds.so to expose internal API commands for reservations
o kea: exit prefix watcher script if no lease file exists
o kea: allow "hw-address" for reservations
o kea: add pool in subnet validation
o kea: minor code cleanups in model code
o kea: fix subnets GUI missing root node
o kea: add required scope to prefix watcher link local address route
o kea: guard prefix watcher when no link-local address exists for a route that should be installed
o kea: add DDNS and DHCP option support
o kea: add DDNS subnet-specific qualifying suffix and prevent updates if no server is set
o kea: add sockets max-retries and retry-wait-time options
o kea: add delete lease command and use socket for up-to-date lease collection
o kea: move pool-in-subnet validation logic mostly to KeaPoolsField
o kea: remove KeaCtrlAgent dependency on HA configuration
o kea: use SetConstraint for match_data to allow 0 as valid value
o monit: use safe config iteration in gateway alert script
o network time: add pool property for time servers (contributed by Konstantinos Spartalis)
o network time: remove stale symlink when PPS is disabled
o openvpn: removed the stale TheGreenBow client export
o openvpn: add options for legacy ciphers (contributed by Bjoern Jakobsen)
o openvpn: debounce learn-address calls to limit the number of alias updates to a minimum
o openvpn: add validation for selecting username as CN without setting any authentication
o radvd: migrated to MVC/API
o radvd: remove faulty empty address exception
o radvd: remove configuration file if disabled
o radvd: implement RemoveAdvOnExit override
o radvd: add Base6Interface constructor
o radvd: support nat64prefix
o radvd: change tabs to spaces in radvd.conf for better maintenance
o radvd: use safe config array iteration over virtual IPs
o radvd: when adding a manual instance for an automatic "track6" interface do not ignore its settings
o unbound: safeguard the blocklist tester against empty configuration testing
o unbound: persist overrides PTR configuration and allow the user to deselect it
o unbound: split logic in update_blocklist() and simplify getPoliciesAction()
o unbound: move policy fetch to the controller and clean up accordingly
o unbound: only emit warning when "addptr" was requested
o unbound: use expand formatter for blocklist URLs and DNSBL types
o unbound: include blocklist length in state change logic
o unbound: add harden below NXDOMAIN option (contributed by Konstantinos Spartalis)
o unbound: consolidate override aliases into tree view
o unbound: deprecate Blocklist.site blocklists (contributed by Drumba08)
o unbound: clean up blocklists update marker and size file handling
o unbound: add per-policy quick actions in reporting overview
o unbound: improve CNAME handling of whitelisted domains
o unbound: safe command execution changes
o unbound: merge extended blocklists into community version
o unbound: prevent caching of blocklist entries on overlapping subnet policies
o unbound: notify user if a blocklist reset is required
o unbound: reconfigure if marker file present
o backend: safe execution changes in the whole code base
o backend: removed short-lived mwexecf_bg() function
o backend: allow non-intrusive config_read_array() and fix a gateway group delete issue with it
o backend: removed mwexec() and mwexec_bg() functions following their deprecation
o backend: add config_push_array() and config_merge_array() helpers
o backend: remove constant configd cleanups as they may influence requests from other threads executing different commands
o backend: remove unused examples throwing errors now
o backend: fix configd using a new temporary file for cached items
o backend: more fixes for re-bound SyntaxWarning throws in Python 3.13
o backend: use config_read_array() non-insert mode mode iteration of virtual IPs
o lang: various translation updates
o lang: various language updates
o mvc: add ChangeCase support to ProtocolField for DNAT special case
o mvc: improve importCsv() to support either comma or semicolon
o mvc: removed long obsolete sessionClose() from ControllerRoot
o mvc: BaseModel: isEmptyAndRequired() has been removed
o mvc: removed unusued RegexField
o mvc: add $separator as parameter for CSV export and switch the default to a semicolon
o mvc: InterfaceField: minor adjustments and add resetStaticOptionList()
o mvc: catch empty data in CSV import
o mvc: restructure menu items and system using findNodeByPath()/getItem() additions
o mvc: BaseListField: generic implementation of static options
o mvc: PortField: make "well-known" port numbers known by allowing them to be mapped to their respective numbers
o mvc: collect UUID field so it can be searched, but only if the searchPhrase contains a valid UUID
o mvc: move CertificateField, InterfaceField and ProtocolField to newer static option API
o mvc: BaseListField: merge remaining use of shared implementation of static options
o mvc: File: add file_update_contents() helper
o mvc: Shell: rewrite exec_safe() to avoid vsprintf() complications
o mvc: BaseListField: replace empty() check with isSet() for proper selection of value "0"
o mvc: HostnameField: show string that failed validation by default
o mvc: BaseField: add setValues() for generic use
o mvc: add SetConstraint for problematic "0" value constraining
o mvc: ApiMutableModelControllerBase: remove unused error returning in setActionHook()
o rc: replace camcontrol with diskinfo for TRIM check (contributed by Maurice Walker)
o rc: speed up maintenance file deletes
o shell: opnsense-log now supports "backend" and "php" aliases
o shell: improve config restore UX using diff and additional meta data display
o tests: Shell: add testing framework
o tests: merge stable filter tests to double check upcoming changes
o ui: allow HTML tags in menu items and title
o ui: improve user readability in SimpleFileUploadDlg()
o ui: batch bootgrid enable/disable-selected toggle by default
o ui: swap order of custom bootgrid commands placement making sure they participate in command binding
o ui: remove two unused static PHP array definitions
o ui: Bootgrid: split row selection behavior into rowSelection boolean
o ui: Bootgrid: force a lightweight redraw when columns are programmatically changed
o ui: Bootgrid: fix curRowCount type conversion issue when stored in localStorage
o ui: bootgrid: require selection to be enabled for delete-selected
o ui: bootgrid: introduce 'expand' formatter to cap lists of data
o ui: set visibility hidden for base_bootgrid_table
o ui: upgrade Tabulator to version 6.4.0
o ui: automatic grid height calculation
o ui: bootgrid: maintain scrolling position for both datatree and command actions
o plugins: os-acme-client 4.15[2]
o plugins: os-caddy 2.1.0[3]
o plugins: os-ddclient 1.29[4]
o plugins: os-freeradius 1.10[5]
o plugins: os-frr 1.51[6]
o plugins: os-haproxy 5.1[7]
o plugins: os-isc-dhcp 1.0[8]
o plugins: os-netbird 1.2
o plugins: os-nextcloud-backup 1.2[9]
o plugins: os-nginx 1.36[10]
o plugins: os-postfix 1.24.1[11]
o plugins: os-q-feeds-connector 1.5[12]
o plugins: os-tailscale 1.4[13]
o plugins: os-tayga 1.5[14]
o plugins: os-theme-cicada 1.41 (contributed by Team Rebellion)
o plugins: os-theme-flexcolor 1.1 (contributed by Schnuffel2008)
o plugins: os-theme-tukan 1.31 (contributed by Team Rebellion)
o plugins: os-theme-vicuna 1.51 (contributed by Team Rebellion)
o plugins: os-turnserver 1.2[15]
o plugins: os-upnp 1.9[16]
o plugins: os-wazuh-agent 1.3[17]
o src: assorted patches from stable/14 for LinuxKPI, QAT, and network stack
o src: if_ovpn: use epoch to free peers
o src: carp6: revise the generation of ND6 NA
o src: igmp: do not upgrade IGMP version beyond net.inet.igmp.default_version
o src: igmp: apply net.inet.igmp.default_version to existing interfaces
o src: ice: handle allmulti flag in ice_if_promisc_set function
o src: icmp6: clear csum_flags on mbuf reuse
o src: divert: Use a better source identifier for netisr_queue_src() calls
o src: if_ovpn: add interface counters
o src: e1000: fix setting the promiscuous mode
o src: pfctl: allow new page character (^L) in pf.conf
o src: sctp: support bridge interfaces
o src: ifconfig: assorted stable fixes
o src: ip_mroute: assorted stable fixes
o src: vtnet: assorted stable fixes
o src: pf: silently ignores certain rules[18]
o src: vnet: ensure the space allocated by vnet_data_alloc() is sufficent aligned
o src: ifnet: Fix decreasing the vnet interface count
o src: e1000: Increase FC pause/refresh time on PCH2 and newer
o src: net80211: fix VHT160/80P80/80 chanwidth selection in the "40-" case
o ports: curl 8.19.0[19]
o ports: dhcp6c v20260122
o ports: expat 2.7.4[20]
o ports: hostwatch 1.0.13
o ports: ldns 1.9.0[21]
o ports: libucl 0.9.4
o ports: libxml 2.15.2[22]
o ports: nss 3.121[23]
o ports: openldap 2.6.13[24]
o ports: openssl 3.0.20[25]
o ports: openvpn 2.6.19[26]
o ports: perl 5.42.2[27]
o ports: phpseclib 3.0.50[28]
o ports: py-duckdb 1.5.0[29]
o ports: python 3.13.13[30]
o ports: strongswan 6.0.4[31]
o ports: suricata 8.0.4[32]
o ports: syslog-ng 4.11.0[33]

Migration notes, known issues and limitations:

o ISC-DHCP moves to a plugin. It will be automatically installed during upgrades. It is not installed on new installations because it is not being used, but you can still install and keep using it.
o To accommodate the change away from ISC-DCHP defaults the "Track interface" IPv6 mode now has a sibling called "Identity Association" which does the same except it is not automatically starting ISC-DHCPv6 and Radvd router advertisements to allow better interoperability with Kea and Dnsmasq setups.
o Dnsmasq is now the default for DHCPv4 and DHCPv6 as well as RA out of the box.  One thing that the upstream software cannot cover is prefix delegation so that is no longer offered by default.  Use another DHCPv6 server in this case.
o Due to command line execution safety concerns the historic functions mwexec_bg() and mwexec() were removed.  Make sure your custom code is not using them and use mwexecf(), mwexecfb() and mwexecfm() instead.
o The function sessionClose() has also been removed from the MVC code and is no longer needed.  Make sure to remove it from your custom code.
o The custom.yaml support has been removed from intrusion detection.  Please migrate to the newer /usr/local/etc/suricata/conf.d override directory.
o The new host discovery service "hostwatch" is enabled by default.  You can always turn it off under Interfaces: Neighbors: Automatic Discovery if you so choose.
o The firewall migration page is not something you need to jump into right away.  Please make yourself familiar with the new rules GUI first and check the documentation for incompatibilities.  Single interface from the floating interface will not be considered "floating" in priorities.
o Firewall: NAT: Port Forwarding is now called "Destination NAT".  Firewall rule associations are no longer supported, but the old associated firewall rules remain in place with their last known configuration and can now be edited to suit future needs.
o Firewall: NAT: Source NAT is from the set of pages formerly known as automation, but Outbound NAT is still the main page for these types of rules.
o Unbound blocklists are now the same between business and community version.  This requires a manual reapply of the blocklists in order to use the new shared format.

The public key for the 26.4 series is:

-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEArTnFQp0jjj5bkLNx9G1j
q26WmN/EtAaJUt+2MY8W8h7L3kokRMlTgEvCYJOkUjbJYbjuG0Cut3JExNYa1vdD
1SLIlJShyI8OsjbAS/flZdJB9c0Vxz2CwpoX9Efmp5TaB3GWqhHS0OVLx4MSI3HJ
qP/aQLjZMuCQHX8beUQB77YWcT6sPC5UMYeNEW1uHR7Oki/TpOXWnzNStEQXRL6/
MiuYJovedlNXeNUeebJyG0TyLJ/3uGMYhHKYK+OJkB03P3iLGGVE/WWNugsqX6bY
tTU9PquHo5zDApndp8iG49Fs/DC0r7V1P85ETPtW2SuZQ7YeDuz3VKvuMxAqyQoC
1FLOsIuEfudDmRuMuTsRgB6jaGACEWUTuRyiFG4+kVDi1/qOWpYatP8C8B7Lx9UU
CTZhCl+Se4woWGtp5KOtYe+pvJ4oz40SL4drUQFEP3ZOsK/HzyLjPFRgxfANNUPG
ONayKHJXVVFPg2ATk9jeNPsLmXlcDmi/rihyN4RM2w0/bi8BWSc+dMGZ5ZhNJdsF
wHBIscgpiAhs+HS8Usxy3idv/JkY0h9tZ2QnljhUUwhYV+DT9yZf5ABU0B68VjJ4
/GloUc3bS7HBeSTAauYMOQvgkY1vcySGWTXvsGOw/Crpk4DYx5KpGNYHmENRey2c
AQdi+Fvi3fFkV1BoxGo78NcCAwEAAQ==
-----END PUBLIC KEY-----

Stay safe,
Your OPNsense team

--
SHA256 (OPNsense-business-26.4-dvd-amd64.iso.bz2) = 201fa8fb384fda534853f2a0fbc82aecbb8753e37a77426f55a1478029b02a2e
SHA256 (OPNsense-business-26.4-nano-amd64.img.bz2) = e133243e85aa630d00d29ea78b8f6fe3b87de06bd7e62f88c3c8fed1b51edb9e
SHA256 (OPNsense-business-26.4-serial-amd64.img.bz2) = 44dfd3a696bd04961145e40478128b75d911f0e8d6a9ea2a6d20a3b6205c7bc5
SHA256 (OPNsense-business-26.4-vga-amd64.img.bz2) = 52c4d12b87c5464f9bfff9124a6c3a1c1dd52bb9a6a16d8e5b5cdeee4f108c78

[1] https://docs.opnsense.org/manual/install.html
[2] https://github.com/opnsense/plugins/blob/stable/26.1/security/acme-client/pkg-descr
[3] https://github.com/opnsense/plugins/blob/stable/26.1/www/caddy/pkg-descr
[4] https://github.com/opnsense/plugins/blob/stable/26.1/dns/ddclient/pkg-descr
[5] https://github.com/opnsense/plugins/blob/stable/26.1/net/freeradius/pkg-descr
[6] https://github.com/opnsense/plugins/blob/stable/26.1/net/frr/pkg-descr
[7] https://github.com/opnsense/plugins/blob/stable/26.1/net/haproxy/pkg-descr
[8] https://github.com/opnsense/plugins/blob/stable/26.1/net/isc-dhcp/pkg-descr
[9] https://github.com/opnsense/plugins/blob/stable/26.1/sysutils/nextcloud-backup/pkg-descr
[10] https://github.com/opnsense/plugins/blob/stable/26.1/www/nginx/pkg-descr
[11] https://github.com/opnsense/plugins/blob/stable/26.1/mail/postfix/pkg-descr
[12] https://github.com/opnsense/plugins/blob/stable/26.1/security/q-feeds-connector/pkg-descr
[13] https://github.com/opnsense/plugins/blob/stable/26.1/security/tailscale/pkg-descr
[14] https://github.com/opnsense/plugins/blob/stable/26.1/net/tayga/pkg-descr
[15] https://github.com/opnsense/plugins/blob/stable/26.1/net/turnserver/pkg-descr
[16] https://github.com/opnsense/plugins/blob/stable/26.1/net/upnp/pkg-descr
[17] https://github.com/opnsense/plugins/blob/stable/26.1/security/wazuh-agent/pkg-descr
[18] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:09.pf.asc
[19] https://curl.se/changes.html#8_19_0
[20] https://github.com/libexpat/libexpat/blob/R_2_7_4/expat/Changes
[21] https://raw.githubusercontent.com/NLnetLabs/ldns/1.9.0/Changelog
[22] https://gitlab.gnome.org/GNOME/libxml2/-/blob/master/NEWS
[23] https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_121.html
[24] https://www.openldap.org/software/release/changes_lts.html
[25] https://github.com/openssl/openssl/blob/openssl-3.0/CHANGES.md
[26] https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn26#Changesin2.6.19
[27] https://perldoc.perl.org/5.42.2/perldelta
[28] https://github.com/phpseclib/phpseclib/releases/tag/3.0.50
[29] https://github.com/duckdb/duckdb/releases/tag/v1.5.0
[30] https://docs.python.org/release/3.13.13/whatsnew/changelog.html
[31] https://github.com/strongswan/strongswan/releases/tag/6.0.4
[32] https://suricata.io/2026/03/17/suricata-8-0-4-and-7-0-15-released/
[33] https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.11.0

Hello, hello,

Yes, we are obviously still alive!  This update addresses a number of security
issues -- first and foremost an injection into LDAP authentication that can
bypass group restrictions during login.  Also included are Curl and OpenSSL
third party updates as well as FreeBSD security advisories.

Further UX tweaks reached the new firewall rules GUI, the MVC grid system and
surprising movement in the Kea corner.  But maybe most importantly: the captive
portal finally gained native IPv6 support.  Let us know what you think about
it!

Here are the full patch notes:

o system: escape LDAP username during search[1] (reported by Matt Andreko)
o system: dashboard gauge improvements (contributed by Konstantinos Spartalis)
o system: compress height of the log viewer grid
o firewall: fix wrong "pass" on DNAT rule when using register rule
o interfaces: configurable cleanups for automatic neighbor discovery via hostwatch
o interfaces: refactor PPP CARP hook
o firewall: adjust sort order in networks and aliases in new rules GUI
o firewall: change sorting to interface/group name and stop caring about counted rules in new rules GUI
o firewall: change category sorting using names instead of counted rules in new rules GUI
o firewall: remove tokenizer from categories and use selectpicker instead  in new rules GUI
o dnsmasq: prevent "*" from being collected as "client_id"
o firmware: repeat the update after pkg reinstall
o kea: add DDNS subnet-specific qualifying suffix and prevent updates if no server is set
o kea: add sockets max-retries and retry-wait-time options
o kea: add delete lease command and use socket for up-to-date lease collection
o kea: move pool-in-subnet validation logic mostly to KeaPoolsField
o kea: remove KeaCtrlAgent dependency on HA configuration
o kea: use SetConstraint for match_data to allow 0 as valid value
o ipsec: add 4 insecure proposals for compatibility (contributed by Bjoern Jakobsen)
o captive portal: add IPv6 support (partially contributed by Alex Goodkind)
o radvd: when adding a manual instance for an automatic "track6" interface do not ignore its settings
o unbound: limit duckdb to a single thread in write mode to reduce logger memory usage
o unbound: add harden below NXDOMAIN option (contributed by Konstantinos Spartalis)
o unbound: consolidate override aliases into tree view
o mvc: BaseListField: replace empty() check with isSet() for proper selection of value "0"
o mvc: HostnameField: show string that failed validation by default
o mvc: BaseField: add setValues() for generic use
o mvc: add SetConstraint for problematic "0" value constraining
o mvc: ApiMutableModelControllerBase: remove unused error returning in setActionHook()
o ui: set visibility hidden for base_bootgrid_table
o ui: upgrade Tabulator to version 6.4.0
o ui: automatic grid height calculation
o ui: bootgrid: maintain scrolling position for both datatree and command actions
o plugins: os-acme-client 4.15[2]
o plugins: os-turnserver 1.2[3]
o src: remote code execution via RPCSEC_GSS packet validation[4]
o src: tcp: remotely exploitable DoS vector[5]
o src: pf: silently ignores certain rules[6]
o src: vnet: ensure the space allocated by vnet_data_alloc() is sufficent aligned
o src: ifnet: Fix decreasing the vnet interface count
o src: e1000: Increase FC pause/refresh time on PCH2 and newer
o src: net80211: fix VHT160/80P80/80 chanwidth selection in the "40-" case
o ports: curl 8.19.0[7]
o ports: hostwatch 1.0.13
o ports: openssl 3.0.20[8]
o ports: perl 5.42.2[9]


Stay safe,
Your OPNsense team

--
[1] https://www.cve.org/cverecord?id=CVE-2026-34578
[2] https://github.com/opnsense/plugins/blob/stable/26.1/security/acme-client/pkg-descr
[3] https://github.com/opnsense/plugins/blob/stable/26.1/net/turnserver/pkg-descr
[4] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:08.rpcsec_gss.asc
[5] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:06.tcp.asc
[6] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:09.pf.asc
[7] https://curl.se/changes.html#8_19_0
[8] https://github.com/openssl/openssl/blob/openssl-3.0/CHANGES.md
[9] https://perldoc.perl.org/5.42.2/perldelta

Howdy,

This updates ships a few third party updates, assorted core fixes and
improvements of which Kea DDNS and options support may be the most
sought-after.

The captive portal IPv6 changes are ready for wider testing on the
development version and over there the grids will now auto-resize as
the limits of the Tabulator UI are pushed farther and further.  ;)

Here are the full patch notes:

o system: cleanup and simplify certificate deployment and remove legacy config import
o system: validate monitor uniqueness based on the host route presence
o system: simplify user/group sync scripts using config_read_array()
o interfaces: clean up overview UI code and fix CARP badge alignment
o interfaces: fix static neighbor apply button (contributed by Konstantinos Spartalis)
o interfaces: simplify CARP scripts using config_read_array()
o interfaces: automatic dhclient recovery
o interfaces: settings page use cases for config_read_array()
o firewall: fix regression in alias summary not shown in new rules GUI
o firewall: invalidate database when last updated time is in the future
o firewall: add missing "static port" option in source NAT
o firewall: add semantic groups coloring option in dashboard widget (contributed by Gunnar Lieb)
o firewall: one-to-one NAT rendered rule missed "log" statement
o firewall: add missing alias rename rule targets
o firewall: add alias GeoIP database update button and move bogons one to the same tab
o firewall: fix port handling in registered NAT rule
o firewall: fix MVC code vs. legacy rules display issues
o firewall: outbound NAT page use case for config_read_array()
o captive portal: cleanup and simplify certificate deployment and remove legacy config import
o captive portal: enforce POST-only on logoffAction() (contributed by Oliver Jueguen)
o dnsmasq: add "no-ping" option (contributed by Konstantinos Spartalis)
o dnsmasq: remove a too-strict validation for suffix IPv6 addresses without constructor use
o dnsmasq: ensure the lease view handles client-id correctly
o ipsec: fix delete selected for SPD and SAD
o kea: add DDNS and DHCP option support
o network time: add pool property for time servers (contributed by Konstantinos Spartalis)
o network time: remove stale symlink when PPS is disabled
o unbound: only emit warning when "addptr" was requested
o unbound: use expand formatter for blocklist URLs and DNSBL types
o unbound: include blocklist length in state change logic
o backend: more fixes for re-bound SyntaxWarning throws in Python 3.13
o backend: use config_read_array() non-insert mode mode iteration of virtual IPs
o mvc: BaseListField: merge remaining use of shared implementation of static options
o mvc: File: add file_update_contents() helper
o mvc: Shell: rewrite exec_safe() to avoid vsprintf() complications
o rc: speed up maintenance file deletes
o ui: bootgrid: require selection to be enabled for delete-selected
o ui: bootgrid: introduce 'expand' formatter to cap lists of data
o plugins: os-frr 1.51[1]
o plugins: os-tayga 1.5[2]
o ports: openldap 2.6.13[3]
o ports: perl 5.42.1[4]
o ports: phpseclib 3.0.50[5]
o ports: py-duckdb 1.5.0[6]
o ports: suricata 8.0.4[7]


Stay safe,
Your OPNsense team

--
[1] https://github.com/opnsense/plugins/blob/stable/26.1/net/frr/pkg-descr
[2] https://github.com/opnsense/plugins/blob/stable/26.1/net/tayga/pkg-descr
[3] https://www.openldap.org/software/release/changes_lts.html
[4] https://perldoc.perl.org/5.42.1/perldelta
[5] https://github.com/phpseclib/phpseclib/releases/tag/3.0.50
[6] https://github.com/duckdb/duckdb/releases/tag/v1.5.0
[7] https://suricata.io/2026/03/17/suricata-8-0-4-and-7-0-15-released/

Hi,

This is basically a maintenance release in assorted areas, but also includes
a CVE for the GUI for missing POST checks in the API.  We thank everyone
for reporting issues and testing the fixes with us to allow for easy and fast
releases such as this one.

The roadmap is almost ready to be published.  Expect it later this week.

Here are the full patch notes:

o system: store dashboard layout types based on column breakpoints
o system: do not show snapshot notes in the grid
o system: use safe config iteration in admin settings page
o reporting: use safe config iteration in RRD code
o interfaces: remove unused ip_in_interface_alias_subnet()
o interfaces: use safe config iteration in PPP edit page
o firewall: fix access to deleted filter node in advanced settings
o firewall: merge MVC NAT page templates into a single one
o firewall: when repopulating the interface selectpicker, always restore current selection in new rules GUI
o firewall: remove hardcoded colors where possible in new rules GUI
o firewall: fix category colors in new rules GUI
o firewall: merge read of groups and interfaces in new rules GUI
o firewall: make MVC protocol selection match the old rules pages
o firewall: add model validations for common errors in destination NAT
o firewall: live view: allow regex use in "contains" cases
o firewall: live view: fix SyntaxWarning in log reader backend
o firewall: use safe iteration in old rule page for schedule lookup
o firewall: use safe config iteration in outbound NAT page
o firmware: add aux repository support
o ipsec: use safe config iteration for VIP lookup
o kea: guard prefix watcher when no link-local address exists for a route that should be installed
o monit: use safe config iteration in gateway alert script
o openvpn: debounce learn-address calls to limit the number of alias updates to a minimum
o openvpn: add validation for selecting username as CN without setting any authentication
o unbound: split logic in update_blocklist() and simplify getPoliciesAction()
o unbound: move policy fetch to the controller and clean up accordingly
o backend: remove unused examples throwing errors now
o backend: fix configd using a new temporary file for cached items
o mvc: ConfigMaintenance: when constructing class names use a safer way to strip .php extension
o mvc: fix CSRF vulnerability in multiple API endpoints by enforcing POST-only requests[1] (contributed by Oliver Jueguen)
o mvc: move CertificateField, InterfaceField and ProtocolField to newer static option API
o shell: improve config restore UX using diff and additional meta data display
o ui: remove two unused static PHP array definitions
o ui: Bootgrid: split row selection behavior into rowSelection boolean
o ui: Bootgrid: force a lightweight redraw when columns are programmatically changed
o ui: Bootgrid: fix curRowCount type conversion issue when stored in localStorage
o lang: various language updates
o ports: libxml 2.15.2[2]
o ports: strongswan 6.0.4[3]
o ports: syslog-ng 4.11.0[4]


Stay safe,
Your OPNsense team

--
[1] https://www.cve.org/cverecord?id=CVE-2026-30868
[2] https://gitlab.gnome.org/GNOME/libxml2/-/blob/master/NEWS
[3] https://github.com/strongswan/strongswan/releases/tag/6.0.4
[4] https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.11.0

Hello,

Stephan worked on a nice extension for the dashboard since some users ran into issues with storing layouts on mobile phones or similarly small screens.

# opnsense-patch https://github.com/opnsense/core/commit/1a1d2dff10079 https://github.com/opnsense/core/commit/ab102b588

With these patches each layout saved will be stored for the respective column size so that you can rearrange the dashboard widgets for each of these screen widths and they properly stick to the configuration.

Feedback is welcome.  The likely merge target for this extension is 26.1.4.


Thanks,
Franco

Hello,

This builds on 26.1.3 and the previous topic https://forum.opnsense.org/index.php?topic=50401.0 and is mainly intended for multi-WAN users with multiple DHCPv6 WAN configurations, because there are some downsides to using only one daemon for all WANs.

This requires the 26.1.3 version to apply cleanly.

# opnsense-patch https://github.com/opnsense/core/commit/c5cb86b

(and reboot)

Why do this? When you have two WANs that both get IPv6 information via DHCPv6 they are currently merged into a single configuration. If one of the two interface is being reconfigured the only dhcp6c process gets a SIGHUP to restart wich restarts IPv6 connectivity for both WANs instead of only the right one. It will at least remove side effects from multi-WAN environments on this level.

The other addition is complete control over prefix association as described in the linked ticket: https://github.com/opnsense/core/issues/7647

This may at least make a few AT&T users happy.  :)

Things that would be useful to know:

1. Is this a fire and forget change first and foremost or does it introduce compatibility issues?
2. Is the new PD association feature working as intended?
3. Are you still using config file overrides and why?

The plan beyond this is likely to remove the "advanced" configuration mode for DHCPv6. I'm not overly fond of the "override" mode but it seems more useful than advanced so it's likely going to stay. So we can merge more advanced settings into the "basic" configuration. In a mid-term MVC/API world it's easier to hide more advanced settings, too.


Cheers,
Franco

Hi and hello,

This update finally brings in Python 3.13 after the struggle we had with
3.11 and missing security patches.  A number of things were fixed for the
new rules GUI as well as assorted minor things in all areas of the code
base.  Two FreeBSD security advisories are also included and a reboot is
needed to finish this update.

Of note are the recent modifications of the firmware scripting as they
follow a fix in 26.1.2 that seems to have resolved the partial upgrade
failures people have been reporting over the last 2 years.  It turned out
that the issue was a cleanup routine in the core package that removed
temporary files in the background while the package manager was still
attempting to install more packages.

Here are the full patch notes:

o system: add note field to store comments for each snapshot
o system: add configurable "memberOf" attribute to LDAP connector
o system: do not scrub unrelated IPv6 DHCP ranges from Dnsmasq LAN config during wizard
o system: adapt DHCP address shell setup for new config access functions
o system: adapt web GUI certificate renew for new config access function
o system: adapt initial port configuration DHCP setting for new config access functions
o system: avoid using "(system)" user revision annotation to match legacy and MVC code
o system: fix log files 'go to page' edge case and row count persistence/max
o system: ignore future backups when they exist to ensure new backups are saved
o system: ensure proper types are emitted in searchGatewayAction() when configd action fails
o system: use safe iteration for cert/ca in system_trust_configure()
o system: fixed broken link in modal header when using HA and saving administration settings
o system: create a backup on factory reset
o system: unify pwd_changed_at usage
o reporting: restore canvas state in health graph to fix Firefox display bug
o interfaces: generalise the dhcp6c_script using the new IFNAME variable
o interfaces: fix enter key in assignment description and general cleanup
o interfaces: protect device reads against forcing empty arrays into $config
o firewall: check for schedules in use in new rules
o firewall: add import/export function and missing lock on set action
o firewall: better focus selected alias updates to in crease performance when either --aliases or --types is used
o firewall: implement missing ICMP types in new rules GUI (contributed by Bjoern Jakobsen)
o firewall: adjust for parseReplace() for icmp-type "skip"
o firewall: fix NAT rule enabled checks display (contributed by Aaron Rogers)
o firewall: prevent separator char from being used in category names
o firewall: fix running into error using well known protocols with "-" in them
o firewall: add validation to prevent using both gateway and reply-to in the same rule in new GUI
o firewall: add a command button to open the live log with pre-filled rule ID in new GUI
o firewall: move download and upload commands out of partial into global commands in new GUI
o firewall: reduce complexity in URL hash handling and when using firewall_rule_lookup.php in new GUI
o firewall: fix default ipprotocol mismatch so that when not specified both are indicated
o firewall: update destination NAT ACL to match our menu entry
o firewall: fix issues with searching in the states page
o firewall: allow well known ports in local-port destination NAT
o firewall: adjust row selection behaviour for internal rules in MVC pages
o firewall: offer aliases the same was as the field type expects them
o dnsmasq: add IP address validations for some of the DHCPv4 and DHCPv6 options (contributed by Greelan)
o firmware: fix automatic advanced toggle in settings
o firmware: shorten the reboot message to fit the spinner on the same line
o firmware: tweaks for update/upgrade cleanup behaviours between core and opnsense-update
o firmware: add support for aux repository handling in opnsense-update
o installer: ufs: ignore errors when flushing the full disk
o intrusion detection: upgrade ET Open ruleset to version 8.0 (contributed by 0nnyx)
o openvpn: add options for legacy ciphers (contributed by Bjoern Jakobsen)
o radvd: use safe config array iteration over virtual IPs
o unbound: persist overrides PTR configuration and allow the user to deselect it
o backend: removed mwexec() and mwexec_bg() functions following their deprecation
o backend: add config_push_array() and config_merge_array() helpers
o backend: remove constant configd cleanups as they may influence requests from other threads executing different commands
o mvc: restructure menu items and system using findNodeByPath()/getItem() additions
o mvc: BaseListField: generic implementation of static options
o mvc: PortField: make "well-known" port numbers known by allowing them to be mapped to their respective numbers
o mvc: collect UUID field so it can be searched, but only if the searchPhrase contains a valid UUID
o tests: merge stable filter tests to double check upcoming changes
o ui: batch bootgrid enable/disable-selected toggle by default
o ui: swap order of custom bootgrid commands placement making sure they participate in command binding
o plugins: os-acme-client 4.14[1]
o plugins: os-caddy 2.1.0[2]
o plugins: os-haproxy 5.1[3]
o plugins: os-netbird 1.2
o plugins: os-nextcloud-backup 1.2[4]
o plugins: os-q-feeds-connector 1.5[5]
o plugins: os-tailscale 1.4[6]
o plugins: os-theme-cicada 1.41 (contributed by Team Rebellion)
o plugins: os-theme-flexcolor 1.1 (contributed by Schnuffel2008)
o plugins: os-theme-tukan 1.31 (contributed by Team Rebellion)
o plugins: os-theme-vicuna 1.51 (contributed by Team Rebellion)
o plugins: os-upnp 1.9[7]
o src: igmp: do not upgrade IGMP version beyond net.inet.igmp.default_version
o src: igmp: apply net.inet.igmp.default_version to existing interfaces
o src: ice: handle allmulti flag in ice_if_promisc_set function
o src: icmp6: clear csum_flags on mbuf reuse
o src: file: qualify pointers to capsicum rights as const
o src: file: add a fd flag with O_RESOLVE_BENEATH semantics
o src: file: Fix the !CAPABILITIES build
o src: unix: Set O_RESOLVE_BENEATH on fds transferred between jails[8]
o src: rtsock: Fix stack overflow[9]
o src: divert: Use a better source identifier for netisr_queue_src() calls
o src: if_ovpn: add interface counters
o src: e1000: fix setting the promiscuous mode
o src: pfctl: allow new page character (^L) in pf.conf
o src: sctp: support bridge interfaces
o src: ifconfig: assorted stable fixes
o src: ip_mroute: assorted stable fixes
o src: vtnet: assorted stable fixes
o ports: libucl 0.9.4
o ports: nss 3.121[10]
o ports: python 3.13.12[11]

Stay safe,
Your OPNsense team

--
[1] https://github.com/opnsense/plugins/blob/stable/26.1/security/acme-client/pkg-descr
[2] https://github.com/opnsense/plugins/blob/stable/26.1/www/caddy/pkg-descr
[3] https://github.com/opnsense/plugins/blob/stable/26.1/net/haproxy/pkg-descr
[4] https://github.com/opnsense/plugins/blob/stable/26.1/sysutils/nextcloud-backup/pkg-descr
[5] https://github.com/opnsense/plugins/blob/stable/26.1/security/q-feeds-connector/pkg-descr
[6] https://github.com/opnsense/plugins/blob/stable/26.1/security/tailscale/pkg-descr
[7] https://github.com/opnsense/plugins/blob/stable/26.1/net/upnp/pkg-descr
[8] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:04.jail.asc
[9] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:05.route.asc
[10] https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_121.html
[11] https://docs.python.org/release/3.13.12/whatsnew/changelog.html