CVE-2026-58390: OPNsense OpenVPN Dashboard Widget XSS Vulnerability

CVE-2026-58390 Overview

CVE-2026-58390 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in OPNsense, a FreeBSD-based firewall and routing platform. The flaw resides in the OpenVPN connection-status dashboard widget (src/opnsense/www/js/widgets/OpenVPNClients.js) and the connection-status view. These components place a client common_name into data-common-name attributes without quote-safe encoding. An authenticated OpenVPN client with a username containing a double quote can inject HTML attributes and event handlers that execute in an administrator's browser session. The injected script can read config.xml, invoke privileged APIs, reset the root password, and obtain root command execution. OPNsense fixed the issue in version 26.1.11.

Critical Impact
Successful exploitation enables full firewall takeover, including root command execution, through script execution in an administrator's authenticated session.

Affected Products

OPNsense versions prior to 26.1.11
Deployments using OpenVPN server with username-as-common-name configuration
Deployments authenticating OpenVPN clients via RADIUS or LDAP backends

Discovery Timeline

2026-10-15 - CVE-2026-58390 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-58390

Vulnerability Analysis

The vulnerability is a stored XSS in the OPNsense web interface. OPNsense renders the OpenVPN client common_name field directly into HTML attribute context without escaping quotes or angle brackets. The connection-status dashboard widget and the connection-status Volt template both construct data-common-name and data-common_name attributes by concatenating the raw value from the connected client.

When an administrator loads the dashboard or opens the connection-status page, the browser parses the attacker-controlled markup. The demonstrated payload triggered on pointer movement over the client row rather than at page load. Once script executes in the administrator's session, it inherits all web-UI privileges, including access to config.xml, privileged API calls, root password reset, and shell command execution.

Root Cause

The root cause is missing output encoding in two files: src/opnsense/www/js/widgets/OpenVPNClients.js and src/opnsense/mvc/app/views/OPNsense/OpenVPN/status.volt. The common_name value flows from the OpenVPN server into HTML attribute context through template literal interpolation and PHP string concatenation. Neither path applies htmlSafe() before injection, allowing a double-quote character to terminate the attribute and introduce event handlers such as onmouseover.

Attack Vector

Exploitation requires an OpenVPN server configured with username-as-common-name and backed by RADIUS or LDAP authentication. The attacker must also be able to provision or self-register a backend username containing a double quote. OPNsense's local user database rejects quotes in usernames, so it is not an exploitation path. Deployments where the same administrator controls both the identity backend and the firewall do not cross a separate trust boundary.

javascript

// Vulnerable code in src/opnsense/www/js/widgets/OpenVPNClients.js
<span class="ovpn-client-command ovpn-command-kill"
  data-row-id="${client.id}"
  data-common-name="${client.common_name}"   // unescaped
  style="cursor: pointer; float:right; margin-left: auto;"
  data-toggle="tooltip"
  title="${this.translations.kill}">

Source: GitHub Commit e7b2ac8

Detection Methods for CVE-2026-58390

Indicators of Compromise

OpenVPN client common_name values containing double-quote characters, angle brackets, or on*= event handler fragments in OpenVPN server logs.
Unexpected RADIUS or LDAP account creations with unusual characters in the username field.
Administrator browser sessions issuing privileged OPNsense API calls (for example, /api/core/firmware/* or user password reset endpoints) shortly after loading the dashboard.
Unexpected modifications to config.xml or root account password changes outside planned maintenance windows.

Detection Strategies

Inspect OpenVPN status endpoints and backend directory listings for usernames that contain ", <, >, =, or / characters.
Correlate dashboard page loads by administrators with subsequent privileged configuration-change API calls from the same session.
Review web server access logs for data-common-name or data-common_name attribute values returned to the administrator UI containing suspicious characters.

Monitoring Recommendations

Monitor identity backend (RADIUS/LDAP) account provisioning events for policy violations, especially non-alphanumeric usernames.
Alert on OPNsense config.xml writes, user-manager password changes, and new privileged API tokens.
Capture outbound requests from administrator workstations to unexpected hosts after dashboard access, which may indicate exfiltration of configuration data.

How to Mitigate CVE-2026-58390

Immediate Actions Required

Upgrade OPNsense to version 26.1.11 or later immediately.
Audit RADIUS and LDAP directories for existing usernames containing quote, angle bracket, or whitespace characters, and remove or rename them.
Rotate the OPNsense root password and any API keys that could have been exposed through an administrator session.
Review config.xml revision history for unauthorized changes.

Patch Information

The fix is included in OPNsense 26.1.11. The patch applies htmlSafe() to the common_name value in both src/opnsense/www/js/widgets/OpenVPNClients.js and src/opnsense/mvc/app/views/OPNsense/OpenVPN/status.volt. See the GitHub Security Advisory GHSA-26cj-h9rj-g5pf, initial commit 11180da, and follow-up commit e7b2ac8.

text

// Patch in src/opnsense/mvc/app/views/OPNsense/OpenVPN/status.volt
- data-common_name="'+row.common_name+'"
+ data-common_name="'+htmlSafe(row.common_name)+'"

// Patch in src/opnsense/www/js/widgets/OpenVPNClients.js
- data-common-name="${client.common_name}"
+ data-common-name="${htmlSafe(client.common_name)}"

Source: GitHub Commit 11180da

Workarounds

Disable the username-as-common-name option on affected OpenVPN server instances until the patch is applied.
Enforce strict username validation in RADIUS/LDAP backends to reject quotes, angle brackets, and HTML metacharacters.
Restrict OpenVPN client enrollment to administrator-controlled workflows, blocking self-registration where feasible.
Avoid opening the OPNsense dashboard or OpenVPN connection-status pages until the upgrade is completed.

bash

# Upgrade OPNsense to the fixed release
opnsense-update -ur
opnsense-update -r 26.1.11
configctl firmware upgrade