CVE-2026-111228: Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php
Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in servicesunboundadvanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in the unvalidated sockqueuetimeout parameter, which is written raw into unbound.conf, to override local records and forwarding for all clients.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated pfSense CE user must have the DNS Resolver: Advanced privilege. Exploitation does not require user interaction and can be performed over the network by a user with that privilege.
What can an attacker change through the injection?
The attacker can inject Unbound directives into unbound.conf through the sock_queue_timeout parameter. This can override local DNS records and forwarding behavior for all clients using the resolver.
Which installations are affected?
The affected version range is pfSense CE 2.7.1 through 2.9.0. The provided information does not state whether the vulnerable parameter is set or reachable in a default configuration.
How can I determine whether a system may have been exploited?
Review the DNS Resolver advanced configuration, particularly the sock_queue_timeout value, for embedded CR/LF characters or unexpected content. Also inspect the generated unbound.conf for unauthorized directives affecting local records or forwarding.