CVE-2026-111227: Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php
Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in servicesunboundacls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF characters in the aclname or aclaction fields written to accesslists.conf to add local-data, local-zone, or forward-zone directives and control DNS answers served to LAN clients.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated to pfSense CE and have the DNS Resolver: Access Lists privilege. The issue affects installations through version 2.9.0.
What can exploitation change for network users?
An attacker can inject Unbound local-data, local-zone, or forward-zone directives into access_lists.conf. This can let them control DNS answers served to LAN clients.
How can administrators check for exploitation?
Review DNS Resolver access-list entries and the generated access_lists.conf for unexpected local-data, local-zone, or forward-zone directives, particularly entries containing embedded line breaks in ACL name or action values.