hostapd 2.12 (26.7.2) — AP broadcasts open/unprotected after upgrade

[cercle]

Titre : hostapd 2.12 (26.7.2) — AP broadcasts open/unprotected after upgrade (WPA security not applied)

Environment

OPNsense version: 26.7.2 (upgraded from 26.7.1_1)
Hardware: PC Engines APU6
Wi-Fi card: wle200nx
hostapd version before: 2.11 (working correctly)
hostapd version after upgrade: 2.12 (issue observed)

Description

After upgrading from 26.7.1_1 to 26.7.2, the Wi-Fi access point configured via hostapd on this system started broadcasting without any WPA/WPA2 protection — the SSID became open and unencrypted, despite the security configuration (WPA2-PSK) remaining unchanged in the GUI (Interfaces → Wireless).

Steps to reproduce

Configure a Wi-Fi interface as AP mode with WPA2-PSK security on 26.7.1_1.
Upgrade to 26.7.2 (bumps hostapd/wpa_supplicant from 2.11 to 2.12).
Observe that the AP is broadcasting open, with no encryption enforced.

Expected behavior

WPA2 security configured in the GUI should be preserved and enforced after the package upgrade.

Actual behavior

AP is open/unprotected, exposing the network to any nearby device without authentication.

Workaround

Reverted hostapd and wpa_supplicant to 2.11 via:

opnsense-revert -r 26.7.1 hostapd wpa_supplicant
pkg lock -y hostapd wpa_supplicant

This restored correct WPA2 enforcement.

Impact

This is a security-relevant regression — administrators upgrading to 26.7.2 with a Wi-Fi AP configured may be unknowingly exposing an open network.

[franco]

Looking at the changelogs this appears to be an unintended change?

https://git.w1.fi/cgit/hostap/plain/hostapd/ChangeLog

There seems to be at least one CVE that warrants 2.12 which is https://nvd.nist.gov/vuln/detail/CVE-2026-58374

If what you are seeing is a change that made old valid configuration invalid we'd have to adjust our code but I have no idea what to look at and no real setup to double-check.


Cheers,
Franco

[cercle]

Thanks Franco — I checked CVE-2026-58374 and I don't think it's related: that CVE is a DoS (crash) in the 802.11be/MLO association-request handling, gated behind CONFIG_IEEE80211BE, and only affects encryption negotiation. My AP isn't using Wi-Fi 7/MLO at all, so this CVE shouldn't touch WPA enforcement.

Hardware: PC Engines APU6, Wi-Fi card: Compex WLE200NX (Atheros AR928x-based, ath driver)

Here's what I can share to help pin down the regression:

interface=ath0_wlan2
driver=bsd
logger_syslog=-1
logger_syslog_level=0
logger_stdout=-1
logger_stdout_level=0
dump_file=/tmp/hostapd_ath0_wlan2.dump
ctrl_interface=/var/run/hostapd
ctrl_interface_group=wheel
#accept_mac_file=/tmp/hostapd_ath0_wlan2.accept
#deny_mac_file=/tmp/hostapd_ath0_wlan2.deny
#macaddr_acl=
ssid=XXXXXXXXXX
debug=
auth_algs=1
wpa=2
wpa_key_mgmt=WPA-PSK
wpa_pairwise=CCMP
wpa_group_rekey=60
wpa_gmk_rekey=3600
wpa_strict_rekey=
wpa_passphrase=XXXXXXXXXXXXXX

OPNsense GUI security mode configured: WPA2-PSK, unchanged across the upgrade

I reverted to hostapd/wpa_supplicant 2.11 via opnsense-revert -r 26.7.1 hostapd wpa_supplicant and the AP is back to enforcing WPA2 correctly, so this looks like a config-parsing or default-value change introduced in 2.12 that overrides or ignores the wpa=/wpa_key_mgmt= directives generated by OPNsense — rather than anything CVE-2026-58374-related. Possibly specific to the ath driver path, but I can't confirm without testing other chipsets.

Happy to test a patch or provide more logs if useful.

[franco]

Thanks for the details. I didn't mean to imply this was CVE-relevant, only that since this fixes security issues not taking the update would not be the best plan either. I'll dig a bit deeper.


Cheers,
Franco

[binaryx]

Hi

is bsd_ driver not compiled with the 2.12 version of hostapd ?

# strings /usr/local/sbin/hostapd | grep bsd_
bsd_route_overflow
bsd_init
bsd_wireless_event_receive
bsd_set_freq
bsd_set_opt_ie
bsd_get_seqnum
bsd_set_key
bsd_del_key
bsd_set_ieee8021x
bsd_get_if_media
bsd_ctrl_iface
bsd_configure_wpa
bsd_set_if_media
bsd_set_privacy

vs new 2.12
# strings /usr/local/sbin/hostapd | grep bsd_
#

which may be confirmed by running
# /usr/local/sbin/hostapd -B -P '/var/run/hostapd_ath0_wlan1.pid' '/var/etc/hostapd_ath0_wlan1.conf'
No drivers enabled
Failed to initialize global context

have bit different hw but similar conf content

[franco]

Well according to the port update nothing was changed (hostapd has no OPTIONS):

https://github.com/opnsense/ports/commit/1feb7d4f85

Can we narrow this down to hostapd being the bad one after 2.12 update?

I checked FreeBSD ports but there were no reports about the recent update (yet).


Cheers,
Franco