CVE-2026-49131: OPNsense Stored XSS Vulnerability

CVE-2026-49131 Overview

CVE-2026-49131 is a stored cross-site scripting (XSS) vulnerability affecting OPNsense versions prior to 26.1.9. The flaw resides in the firewall rule description field, which is exposed through the filter API endpoint. Authenticated users with firewall rule management privileges can persist arbitrary HTML or JavaScript payloads that later execute in the browser of any operator viewing the Firewall Rules page. The vulnerability is classified under CWE-79 and enables session hijacking and credential theft against administrators of the firewall appliance.

Critical Impact
Authenticated attackers can inject persistent JavaScript into the OPNsense administrative interface, hijacking sessions of privileged users who view the Firewall Rules page.

Affected Products

OPNsense Community Edition versions prior to 26.1.9
OPNsense Business Edition builds sharing the vulnerable opnsense_bootgrid.js renderer
Deployments exposing the filter API endpoint to users with firewall rule management privileges

Discovery Timeline

2026-08-03 - CVE-2026-49131 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-49131

Vulnerability Analysis

The vulnerability stems from missing output encoding in the OPNsense web UI. When an authenticated user submits a firewall rule through the filter API, the description field is stored without HTML sanitization. The OPNsense front-end uses a shared grid component, opnsense_bootgrid.js, whose default cell formatter assigns raw cell content to innerHTML. This renders any embedded <script> tags or event handlers as executable markup in the DOM.

Exploitation requires an authenticated account with firewall rule management privileges, so the primary threat model involves lower-privileged operators escalating against administrators. When an administrator opens the Firewall Rules page, the injected payload executes with the administrator's session context, exposing session cookies, CSRF tokens, and API credentials.

Root Cause

The root cause is the absence of HTML escaping on the $rule->getDescr() value inside src/www/firewall_rules.php. The template emitted user-controlled data directly into a <td> element. Compounding this, the opnsense_bootgrid.js grid renderer assigns cell content via innerHTML rather than textContent, which converts stored strings into live DOM nodes.

Attack Vector

An authenticated attacker with rule management rights sends a crafted request to the filter API, embedding a payload in the rule description. The payload persists in the OPNsense configuration. Any subsequent visit to the Firewall Rules page by an authenticated user triggers execution in that user's browser session.

php

                       <td class="view-stats" id="<?=$rule->getLabel();?>_packets"><?= gettext('N/A') ?></td>
                       <td class="view-stats" id="<?=$rule->getLabel();?>_bytes"><?= gettext('N/A') ?></td>
                       <td class="rule-description">
-                        <?=$rule->getDescr();?>
+                        <?=html_safe($rule->getDescr());?>
                         <div class="collapse rule_md5_hash">
                             <small><?=$filterent['label'];?></small>
                         </div>

Source: OPNsense core commit b11d6b3. The patch wraps getDescr() in the html_safe() helper, escaping HTML metacharacters before they reach the browser.

Detection Methods for CVE-2026-49131

Indicators of Compromise

Firewall rule descriptions containing <script>, <img onerror=, javascript:, or other HTML/JavaScript syntax rather than plain descriptive text
Audit log entries showing filter API calls that write unusually long or encoded description fields
Unexpected outbound requests from administrator browsers to attacker-controlled hosts shortly after loading the Firewall Rules page

Detection Strategies

Review the config.xml backup or the running configuration for rule descriptions that contain angle brackets, quote characters, or URL-encoded payloads.
Monitor OPNsense audit logs for PUT and POST requests to the filter API endpoint made by non-administrative accounts.
Enable browser Content Security Policy (CSP) reporting on the OPNsense management interface to surface inline-script violations.

Monitoring Recommendations

Alert on new or modified firewall rules where the description field contains HTML tags or JavaScript keywords.
Track administrator session activity for anomalous API calls immediately after a Firewall Rules page load, which can indicate exfiltrated session tokens.
Restrict management-interface reachability and log all authentication events to the firewall web GUI for correlation.

How to Mitigate CVE-2026-49131

Immediate Actions Required

Upgrade OPNsense to version 26.1.9 or later, which introduces the html_safe() escape on rule descriptions.
Audit all existing firewall rules and remove or rewrite descriptions containing HTML or script content.
Rotate administrative credentials and API keys if you identify suspicious descriptions predating the patch.

Patch Information

The fix is delivered in OPNsense 26.1.9. See the OPNsense CE 26.1 release notes and the upstream fix in core commit b11d6b3. Additional context is available in the VulnCheck advisory.

Workarounds

Restrict firewall rule management privileges to trusted administrators until the patch is applied.
Limit access to the OPNsense web GUI to a dedicated management network or VPN.
Instruct operators to review rule descriptions via the API or CLI rather than the Firewall Rules page while the deployment remains unpatched.

bash

# Verify the installed OPNsense version and upgrade to the patched release
opnsense-version
opnsense-update -ur
configctl firmware upgrade