CVE-2026-38961: Netgate pfSense XSS Vulnerability

CVE-2026-38961 Overview

CVE-2026-38961 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the RSS Widget of Netgate pfSense Plus and pfSense Community Edition (CE). The vulnerability affects pfSense Plus versions 26.03 and 25.11.1, and pfSense CE version 2.8.1. The RSS widget renders feed titles without proper output encoding. Remote authenticated attackers can inject arbitrary JavaScript through a malicious RSS feed title, which executes in the browser of any authenticated user who views the dashboard.

Critical Impact
Successful exploitation executes attacker-controlled JavaScript in the pfSense web interface, enabling session hijacking, dashboard manipulation, or pivoting to firewall configuration changes.

Affected Products

Netgate pfSense Plus version 26.03
Netgate pfSense Plus version 25.11.1
Netgate pfSense CE version 2.8.1

Discovery Timeline

2026-09-04 - CVE-2026-38961 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-38961

Vulnerability Analysis

The pfSense dashboard includes an RSS widget that fetches and displays remote feed content. The widget renders each item's title directly into the dashboard HTML without sanitization or encoding. An authenticated user with permission to configure the widget can point it at an attacker-controlled RSS feed. When the widget parses the feed, any HTML or <script> markup contained in the <title> element becomes part of the rendered dashboard page.

Because the payload persists in the widget configuration and executes for every user who loads the dashboard, this is a stored XSS with a scope change. Injected code runs in the security context of the pfSense web interface, giving it access to session cookies, CSRF tokens, and administrative endpoints reachable by the victim.

Root Cause

The vulnerable code in src/usr/local/www/widgets/widgets/rss.widget.php emitted $item->get_title() directly into the response. The parser (SimplePie) returns the raw feed value, and pfSense performed neither HTML entity encoding nor tag stripping before rendering. The fix applies both strip_tags() and htmlspecialchars() to the title before output.

Attack Vector

Exploitation requires an authenticated user with privileges to configure the RSS widget URL. The attacker hosts an RSS feed whose <title> element contains a JavaScript payload. Once the widget is configured with that feed URL, the payload executes for every authenticated user who loads the dashboard, including administrators.

php

// Patch: src/usr/local/www/widgets/widgets/rss.widget.php
 ?>
 	<a href="<?=$item->get_permalink()?>" target="_blank" class="list-group-item">
 		<h4 class="list-group-item-heading">
-			<?=$item->get_title()?>
+			<?=htmlspecialchars(strip_tags($item->get_title()))?>
 		</h4>
 		<p class="list-group-item-text">
 			<?=textLimit($content, $rsswidgettextlength)?>

Source: pfSense commit 9363ac5. The patched code strips HTML tags with strip_tags() and then encodes remaining special characters with htmlspecialchars() before rendering the title.

Detection Methods for CVE-2026-38961

Indicators of Compromise

Unexpected RSS feed URLs configured in dashboard widget settings, particularly pointing to external or unknown domains.
Feed responses containing <script>, onerror=, onload=, or javascript: sequences within <title> elements.
Dashboard requests to /widgets/widgets/rss.widget.php immediately followed by anomalous administrative actions from the same session.

Detection Strategies

Inspect the pfSense widget configuration (/conf/config.xml) for RSS widget entries and validate that each configured feed URL is expected and trusted.
Deploy a Content Security Policy (CSP) or web application firewall rule that flags inline scripts served from the pfSense management interface.
Log and review outbound HTTP requests from pfSense hosts to RSS endpoints to identify attacker-controlled feed sources.

Monitoring Recommendations

Alert on modifications to dashboard widget configuration by non-administrative accounts.
Correlate authenticated web sessions with unexpected configuration changes or credential exports following dashboard access.
Capture and review browser console errors reported by administrators viewing the pfSense dashboard.

How to Mitigate CVE-2026-38961

Immediate Actions Required

Upgrade pfSense Plus and pfSense CE to a fixed release containing commit 9363ac5b8651a1c7a333180425ce7719070f95f9.
Audit the RSS widget configuration on every pfSense dashboard and remove any feed URLs that were not explicitly approved.
Restrict web interface access to trusted management networks and enforce strong authentication for administrative accounts.

Patch Information

Netgate published the fix through the Netgate Security Advisory pfSense-SA-26_04.webgui and merged the code change in pfSense commit 9363ac5. Apply vendor updates through the standard pfSense system updater once the fixed version is available for your channel.

Workarounds

Disable the RSS widget on all dashboards until the patched version is deployed.
Limit widget configuration privileges to a minimal set of trusted administrators through pfSense user and group permissions.
Front the pfSense web interface with a reverse proxy that enforces a strict Content Security Policy blocking inline scripts.

bash

# Remove the RSS widget from a user's dashboard configuration
# Back up config first
cp /conf/config.xml /conf/config.xml.bak

# Edit the dashboard widget list to remove 'rss:col1:...' entries
# then reload the configuration
/etc/rc.reload_all