CVE-2026-49132: OPNsense Stored XSS Vulnerability

CVE-2026-49132 Overview

CVE-2026-49132 is a stored cross-site scripting (XSS) vulnerability in OPNsense versions before 26.1.9. Authenticated attackers can inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field through the trust certificate API. The unsanitized value is persisted and later rendered by the Dashboard Certificates widget without proper encoding. Any authenticated user who loads the Dashboard triggers execution of the injected script in their browser context. This enables session hijacking, credential theft, and unauthorized actions performed on behalf of the victim user. The flaw is tracked under CWE-79.

Critical Impact
Authenticated attackers can persist JavaScript payloads that execute in the browsers of Dashboard users, leading to session hijacking and credential theft.

Affected Products

OPNsense Community Edition versions before 26.1.9
OPNsense Dashboard Certificates widget (Certificates.js)
OPNsense trust certificate API endpoint

Discovery Timeline

2026-08-03 - CVE-2026-49132 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-49132

Vulnerability Analysis

The vulnerability resides in the OPNsense Dashboard Certificates widget implemented in src/opnsense/www/js/widgets/Certificates.js. The widget constructs HTML rows using template literals that interpolate certificate metadata directly into both attribute and text content sinks. The certificate descr field, submitted via the trust certificate API, is stored verbatim in the configuration and later rendered without HTML entity encoding.

Because the value is placed inside a data-tooltip attribute and then reflected on the Dashboard for every authenticated user, a single malicious certificate description propagates the payload to any operator viewing the widget. Successful exploitation runs script in the authenticated user's session, allowing the attacker to abuse existing web privileges within OPNsense.

Root Cause

The root cause is missing output encoding in the client-side rendering path. The Certificates.js template inserted the raw item.descr value into an HTML attribute using JavaScript template literals, treating attacker-controlled input as trusted markup. Neither the API layer nor the widget sanitized the description before storage or rendering, violating the neutralization requirements described in CWE-79.

Attack Vector

An attacker with authenticated access and permission to create or modify trust certificates sends a request to the certificate API containing an HTML or JavaScript payload in the descr field. When any authenticated user subsequently loads the Dashboard, the Certificates widget renders the malicious content and the browser executes the script.

javascript

// Patch from src/opnsense/www/js/widgets/Certificates.js
// Removes the unescaped data-tooltip attribute in favor of Bootstrap tooltips
const row = `
    <div>
        <i class="${iconClass} ${colorClass} certificate-tooltip" style="cursor: pointer;"
-           data-tooltip="${type}-${item.descr}" title="${statusText}">
+           data-toggle="tooltip" title="${statusText}">
        </i>
         
        <span>${descrContent}</span>
`;
// Source: https://github.com/opnsense/core/commit/12b021ff11db38705e92ac4c9af5e07d602da6ba

Detection Methods for CVE-2026-49132

Indicators of Compromise

Trust certificate entries whose descr field contains HTML tags, <script> blocks, event handler attributes such as onerror or onload, or JavaScript URI schemes.
Unexpected outbound requests from operator browsers to attacker-controlled hosts shortly after Dashboard access.
Audit log entries showing certificate creation or modification followed by session activity from unfamiliar IP addresses.

Detection Strategies

Query the OPNsense configuration for certificate objects and flag any descr value containing angle brackets, quote characters, or javascript: prefixes.
Review web server access logs for POST requests to the trust certificate API that contain suspicious payload characters in the description parameter.
Correlate certificate modification events with subsequent authentication anomalies, such as new session tokens issued from different geolocations.

Monitoring Recommendations

Enable and forward OPNsense audit logs to a centralized log platform for retention and search.
Alert on any modification to the trust certificate store performed by non-administrative accounts.
Monitor Dashboard user sessions for Content Security Policy violation reports if CSP headers are enforced by a reverse proxy.

How to Mitigate CVE-2026-49132

Immediate Actions Required

Upgrade OPNsense to version 26.1.9 or later, which contains the fix committed in 12b021ff11db38705e92ac4c9af5e07d602da6ba.
Audit existing trust certificate entries and remove or sanitize any descr values containing HTML or script content.
Rotate credentials and invalidate active sessions for administrators who may have viewed a poisoned Dashboard.

Patch Information

The fix ships in OPNsense 26.1.9 as documented in the OPNsense Release Notes. The upstream change removes the unescaped data-tooltip attribute from the Certificates widget and switches to the Bootstrap data-toggle="tooltip" mechanism, which reads from the safely encoded title attribute. Full technical context is available in the VulnCheck Security Advisory and the GitHub commit.

Workarounds

Restrict trust certificate management privileges to a minimal set of trusted administrators until the patch is applied.
Remove the Certificates widget from the Dashboard configuration to prevent client-side rendering of the vulnerable field.
Place a reverse proxy in front of the OPNsense web interface and enforce a strict Content Security Policy that blocks inline script execution.

bash

# Verify installed OPNsense version and upgrade to 26.1.9 or later
opnsense-version
opnsense-update -u