CVE-2026-58394: OPNsense: Stored XSS in Administration Settings via Certificate Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/systemadvancedadmin.php reads certificate records into $acert but omits that array from legacyhtmlescapeformdata() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration. This issue is fixed in version 26.1.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OPNsenseto a version that resolves this vulnerability.Fixed in 26.1.11
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the stored payload?
An attacker needs the page-system-certmanager privilege to create or modify a certificate description containing HTML markup. The payload executes when another user opens System Settings Administration and the SSL Certificate selector renders the malicious description.
Are default OPNsense installations affected?
The issue affects OPNsense versions before 26.1.11 when an attacker has the required certificate-manager privilege and a user visits System Settings Administration. The provided data does not state whether that privilege is assigned by default.
How can I determine whether an appliance is affected?
Check the OPNsense version: versions earlier than 26.1.11 are affected. On those systems, inspect certificate descriptions for unexpected HTML or script-like markup, particularly where users with the page-system-certmanager privilege could have edited certificates.
What should be done if upgrading is not immediately possible?
Restrict the page-system-certmanager privilege to trusted administrators and review existing certificate descriptions for malicious markup. Avoid opening System Settings Administration from potentially exposed administrator sessions until suspicious descriptions are removed.