hostapd 2.12 (26.7.2) — AP broadcasts open/unprotected after upgrade

[cercle]

Titre : hostapd 2.12 (26.7.2) — AP broadcasts open/unprotected after upgrade (WPA security not applied)

Environment

OPNsense version: 26.7.2 (upgraded from 26.7.1_1)
Hardware: PC Engines APU6
Wi-Fi card: wle200nx
hostapd version before: 2.11 (working correctly)
hostapd version after upgrade: 2.12 (issue observed)

Description

After upgrading from 26.7.1_1 to 26.7.2, the Wi-Fi access point configured via hostapd on this system started broadcasting without any WPA/WPA2 protection — the SSID became open and unencrypted, despite the security configuration (WPA2-PSK) remaining unchanged in the GUI (Interfaces → Wireless).

Steps to reproduce

Configure a Wi-Fi interface as AP mode with WPA2-PSK security on 26.7.1_1.
Upgrade to 26.7.2 (bumps hostapd/wpa_supplicant from 2.11 to 2.12).
Observe that the AP is broadcasting open, with no encryption enforced.

Expected behavior

WPA2 security configured in the GUI should be preserved and enforced after the package upgrade.

Actual behavior

AP is open/unprotected, exposing the network to any nearby device without authentication.

Workaround

Reverted hostapd and wpa_supplicant to 2.11 via:

opnsense-revert -r 26.7.1 hostapd wpa_supplicant
pkg lock -y hostapd wpa_supplicant

This restored correct WPA2 enforcement.

Impact

This is a security-relevant regression — administrators upgrading to 26.7.2 with a Wi-Fi AP configured may be unknowingly exposing an open network.

[franco]

Looking at the changelogs this appears to be an unintended change?

https://git.w1.fi/cgit/hostap/plain/hostapd/ChangeLog

There seems to be at least one CVE that warrants 2.12 which is https://nvd.nist.gov/vuln/detail/CVE-2026-58374

If what you are seeing is a change that made old valid configuration invalid we'd have to adjust our code but I have no idea what to look at and no real setup to double-check.


Cheers,
Franco

[cercle]

Thanks Franco — I checked CVE-2026-58374 and I don't think it's related: that CVE is a DoS (crash) in the 802.11be/MLO association-request handling, gated behind CONFIG_IEEE80211BE, and only affects encryption negotiation. My AP isn't using Wi-Fi 7/MLO at all, so this CVE shouldn't touch WPA enforcement.

Hardware: PC Engines APU6, Wi-Fi card: Compex WLE200NX (Atheros AR928x-based, ath driver)

Here's what I can share to help pin down the regression:

interface=ath0_wlan2
driver=bsd
logger_syslog=-1
logger_syslog_level=0
logger_stdout=-1
logger_stdout_level=0
dump_file=/tmp/hostapd_ath0_wlan2.dump
ctrl_interface=/var/run/hostapd
ctrl_interface_group=wheel
#accept_mac_file=/tmp/hostapd_ath0_wlan2.accept
#deny_mac_file=/tmp/hostapd_ath0_wlan2.deny
#macaddr_acl=
ssid=XXXXXXXXXX
debug=
auth_algs=1
wpa=2
wpa_key_mgmt=WPA-PSK
wpa_pairwise=CCMP
wpa_group_rekey=60
wpa_gmk_rekey=3600
wpa_strict_rekey=
wpa_passphrase=XXXXXXXXXXXXXX

OPNsense GUI security mode configured: WPA2-PSK, unchanged across the upgrade

I reverted to hostapd/wpa_supplicant 2.11 via opnsense-revert -r 26.7.1 hostapd wpa_supplicant and the AP is back to enforcing WPA2 correctly, so this looks like a config-parsing or default-value change introduced in 2.12 that overrides or ignores the wpa=/wpa_key_mgmt= directives generated by OPNsense — rather than anything CVE-2026-58374-related. Possibly specific to the ath driver path, but I can't confirm without testing other chipsets.

Happy to test a patch or provide more logs if useful.

[franco]

Thanks for the details. I didn't mean to imply this was CVE-relevant, only that since this fixes security issues not taking the update would not be the best plan either. I'll dig a bit deeper.


Cheers,
Franco

[binaryx]

Hi

is bsd_ driver not compiled with the 2.12 version of hostapd ?

# strings /usr/local/sbin/hostapd | grep bsd_
bsd_route_overflow
bsd_init
bsd_wireless_event_receive
bsd_set_freq
bsd_set_opt_ie
bsd_get_seqnum
bsd_set_key
bsd_del_key
bsd_set_ieee8021x
bsd_get_if_media
bsd_ctrl_iface
bsd_configure_wpa
bsd_set_if_media
bsd_set_privacy

vs new 2.12
# strings /usr/local/sbin/hostapd | grep bsd_
#

which may be confirmed by running
# /usr/local/sbin/hostapd -B -P '/var/run/hostapd_ath0_wlan1.pid' '/var/etc/hostapd_ath0_wlan1.conf'
No drivers enabled
Failed to initialize global context

have bit different hw but similar conf content

[franco]

Well according to the port update nothing was changed (hostapd has no OPTIONS):

https://github.com/opnsense/ports/commit/1feb7d4f85

Can we narrow this down to hostapd being the bad one after 2.12 update?

I checked FreeBSD ports but there were no reports about the recent update (yet).


Cheers,
Franco

[binaryx]

is related to the upgrade of hostapd

root@#host#:/tmp # hostapd -v
hostapd v2.11
User space daemon for IEEE 802.11 AP management,
IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator
Copyright (c) 2002-2024, Jouni Malinen <j@w1.fi> and contributors
root@#host#:/tmp # hostapd /tmp/test_hostapd.conf
ath0_wlan1: interface state UNINITIALIZED->ENABLED
ath0_wlan1: AP-ENABLED
^Cath0_wlan1: interface state ENABLED->DISABLED
ath0_wlan1: AP-DISABLED
ath0_wlan1: CTRL-EVENT-TERMINATING
root@#host#:/tmp # /usr/local/sbin/hostapd -v
hostapd v2.12
User space daemon for IEEE 802.11 AP management,
IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator
Copyright (c) 2002-2026, Jouni Malinen <j@w1.fi> and contributors
root@#host#:/tmp # /usr/local/sbin/hostapd /tmp/test_hostapd.conf
No drivers enabled
Failed to initialize global context
root@#host#:/tmp # cat /tmp/test_hostapd.conf
interface=ath0_wlan1
driver=bsd
ssid=testchannel=1
root@#host#:/tmp #

[franco]

If I read this correctly

@${SED} -e 's|/usr/local|${PREFIX}|g;s|^CONFIG_DRIVER_NL80211|#CONFIG_DRIVER_NL80211|' ${BUILD_WRKSRC}/defconfig \

then the update disables the CONFIG_DRIVER_NL80211 driver but I am unsure why...

https://github.com/freebsd/freebsd-ports/commit/f37b72501

doesn't tell us about the intention either

[franco]

Well now we know:

../src/drivers/driver_nl80211.c:18:10: fatal error: 'netlink/genl/genl.h' file not found
   18 | #include <netlink/genl/genl.h>
      |          ^~~~~~~~~~~~~~~~~~~~~
1 error generated.
gmake: *** [../src/build.rules:87: /usr/obj/usr/ports/net/hostapd/work/hostapd-2.12/build/hostapd/src/drivers/driver_nl80211.o] Error 1

Not great. But this is a Linux driver so I wonder if they switched BSD default to Linux or altered the detection?

[franco]

How is this one?

# opnsense-revert -z hostapd


Cheers,
Franco

[franco]

Hoping for a response so this can go out in a timely hotfix...

[binaryx]

sorry .. ;) as removed some config had to revert :D .. seems ok to me

[binaryx]

sorry .. ;) as removed some config had to revert :D .. seems ok to me

ath0_wlan1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
   description: W5G (opt1)
   options=0
   ether 48:8f:5a:64:83:71
   inet 10.0.1.254 netmask 0xffffff00 broadcast 10.0.1.255
   groups: wlan
   ssid ~~~~~ channel 52 (5260 MHz 11a ht/20) bssid 48:8f:5a:64:83:71
   regdomain ETSI2 country SK indoor ecm authmode WPA2/802.11i
   privacy MIXED deftxkey 2 AES-CCM 2:128-bit AES-CCM 3:128-bit
   txpower 24 mcastrate 6 mgmtrate 6 scanvalid 60 ampdulimit 64k
   ampdudensity 8 shortgi -uapsd burst -apbridge dtimperiod 1 -dfs
   parent interface: ath0
   media: IEEE 802.11 Wireless Ethernet autoselect mode 11na <hostap>
   status: running
   nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>

[franco]

Ok that seems to be the problem then: https://github.com/opnsense/ports/commit/aa301233

I'll hotfix this now. Thanks for the pointers!


Cheers,
Franco

[cercle]

Confirmed fixed and closing the loop: updated to the official 2.12 release (hostapd 2.12_2, wpa_supplicant 2.12_1, both synced and unlocked now). WPA2 is enforced correctly on the AP — tested again via external scan and client connection, all good.

Thanks for the fast fix and for walking through the snapshot test — much appreciated!