hostapd 2.12 (26.7.2) — AP broadcasts open/unprotected after upgrade

[cercle]

Titre : hostapd 2.12 (26.7.2) — AP broadcasts open/unprotected after upgrade (WPA security not applied)

Environment

OPNsense version: 26.7.2 (upgraded from 26.7.1_1)
Hardware: PC Engines APU6
Wi-Fi card: wle200nx
hostapd version before: 2.11 (working correctly)
hostapd version after upgrade: 2.12 (issue observed)

Description

After upgrading from 26.7.1_1 to 26.7.2, the Wi-Fi access point configured via hostapd on this system started broadcasting without any WPA/WPA2 protection — the SSID became open and unencrypted, despite the security configuration (WPA2-PSK) remaining unchanged in the GUI (Interfaces → Wireless).

Steps to reproduce

Configure a Wi-Fi interface as AP mode with WPA2-PSK security on 26.7.1_1.
Upgrade to 26.7.2 (bumps hostapd/wpa_supplicant from 2.11 to 2.12).
Observe that the AP is broadcasting open, with no encryption enforced.

Expected behavior

WPA2 security configured in the GUI should be preserved and enforced after the package upgrade.

Actual behavior

AP is open/unprotected, exposing the network to any nearby device without authentication.

Workaround

Reverted hostapd and wpa_supplicant to 2.11 via:

opnsense-revert -r 26.7.1 hostapd wpa_supplicant
pkg lock -y hostapd wpa_supplicant

This restored correct WPA2 enforcement.

Impact

This is a security-relevant regression — administrators upgrading to 26.7.2 with a Wi-Fi AP configured may be unknowingly exposing an open network.