CVE-2026-123025: OS Command Injection
An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare() method decodes the dnsgcloudkey model field and directly interpolates the string fields gcloudaccount and gcloudproject into a shell command passed to procopen() via LeUtils::runshellcommand() without any validation or escaping. A remote authenticated user with privileges to issue or renew certificates through the WebGUI/API can achieve arbitrary code execution as root.
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated and have privileges to issue or renew certificates through the OPNsense WebGUI or API. The affected functionality is the Google Cloud DNS validation module in os-acme-client.
What access or configuration is required for exploitation?
The attacker needs access to set values in the dns_gcloud_key model field used by the Google Cloud DNS validation configuration. They can inject shell commands through the gcloud_account or gcloud_project string fields when certificate issuance or renewal invokes the affected code path.
What is the impact of successful exploitation?
Successful exploitation allows arbitrary command execution as root on the OPNsense system. This can compromise confidentiality, integrity, and availability of the appliance and related systems.
How can I determine whether my deployment is affected?
Check whether os-acme-client through version 4.17 is installed and whether it uses the Google Cloud DNS validation module. Review which WebGUI or API accounts can issue or renew certificates, especially accounts able to modify Google Cloud DNS credential settings.