CVE-2026-58391: OPNsense Firewall Stored XSS Vulnerability

CVE-2026-58391 Overview

CVE-2026-58391 is a stored Cross-Site Scripting (XSS) vulnerability in OPNsense, a FreeBSD-based firewall and routing platform. The flaw affects versions prior to 26.1.11. Firewall Rules and NAT views render stored category names and alias descriptions inside HTML title attributes within filter_rule.volt and nat_rule.volt without quote-safe encoding. The response layer uses ENT_NOQUOTES, allowing a double quote to close the attribute and inject an event handler. The weakness is tracked as [CWE-79]. OPNsense fixed the issue in version 26.1.11.

Critical Impact
An authenticated user with Firewall Categories or Alias Edit privileges can store JavaScript that executes in an administrator's browser session, enabling CSRF token theft and authenticated actions as the victim.

Affected Products

OPNsense versions prior to 26.1.11
filter_rule.volt view component (Firewall Rules page)
nat_rule.volt view component (NAT Rules page)

Discovery Timeline

2026-10-15 - CVE-2026-58391 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-58391

Vulnerability Analysis

The vulnerability is a stored XSS flaw in OPNsense's web UI rendering layer. Category names and alias descriptions are included in HTML title tooltip attributes using JavaScript template literals without proper attribute-context encoding. Because OPNsense's response-side HTML encoding uses PHP's ENT_NOQUOTES flag, double quote characters pass through unescaped. An attacker can inject a payload containing a literal " to close the title attribute and append an event handler such as onmouseover to the surrounding <span> element.

Exploitation requires an authenticated user with Firewall Categories or Firewall Alias Edit privileges. The injected category must be assigned to a filter or NAT rule, or the alias must be referenced by a rule's source or destination. The rule must then be saved so the tooltip is rendered on the Rules or NAT page. When an administrator opens the affected page, the script runs in their session and can read CSRF material and issue authenticated requests on their behalf.

Root Cause

The root cause is improper neutralization of input used in HTML attribute context. Rendering code in filter_rule.volt and nat_rule.volt interpolated untrusted strings directly into a title="..." attribute without a quote-aware escaping helper such as htmlSafe(). Combined with the ENT_NOQUOTES encoding posture elsewhere in the response layer, the double quote delimiter survived and could be used to break out of the attribute.

Attack Vector

The attack vector is network-based and requires low privileges plus user interaction from a higher-privileged victim. A low-privileged firewall operator creates or edits a category or alias with a crafted name or description, binds it to a filter or NAT rule, and waits for an administrator to browse the affected rules page.

text

// Patch diff - filter_rule.volt (unescaped title attribute)
                            const classColor = ruleType? ruleType.color : '';
                            const bgColor = cat.color ? ` style="color:${cat.color};"` : '';
                            return `
-                                <span class="category-icon" data-toggle="tooltip" title="${name}">
+                                <span class="category-icon" data-toggle="tooltip" title="${htmlSafe(name)}">
                                    <i class="fa fa-fw ${icon} ${classColor}" ${bgColor}></i>
                                </span>`;
                        }).join(' ');

Source: OPNsense core commit 5e6313f

The patch wraps the user-controlled name value with htmlSafe() to encode quote characters before interpolation into the title attribute. The identical fix is applied to nat_rule.volt for the cat.name field.

Detection Methods for CVE-2026-58391

Indicators of Compromise

Firewall category names or alias descriptions containing characters such as ", <, >, or event-handler fragments like onmouseover=, onerror=, or onclick=.
Unexpected outbound requests from administrator browser sessions when opening the Firewall Rules or NAT pages.
Audit log entries showing configuration changes performed by an administrator shortly after a Rules or NAT page view, with no corresponding console activity.

Detection Strategies

Review all stored category names and alias descriptions in the OPNsense configuration (config.xml) for anomalous characters or script-like payloads.
Inspect browser developer tools or network traces when loading the Firewall Rules and NAT pages for script execution originating from tooltip markup.
Correlate recent create or edit activity by users holding Firewall Categories or Firewall Alias Edit privileges against subsequent administrator sessions.

Monitoring Recommendations

Enable and centralize OPNsense audit logs to track category and alias edits along with the rule bindings that render them.
Monitor administrator session activity for unusual API calls that could indicate CSRF-driven abuse originating from the web UI.
Alert on new or modified categories and aliases whose textual fields contain HTML metacharacters.

How to Mitigate CVE-2026-58391

Immediate Actions Required

Upgrade OPNsense to version 26.1.11 or later, which escapes user-controlled values in tooltip attributes.
Audit existing categories and aliases, removing or sanitizing any entries containing HTML metacharacters before administrators next open the Rules or NAT pages.
Restrict Firewall Categories and Firewall Alias Edit privileges to trusted operators only.

Patch Information

The fix is delivered in OPNsense version 26.1.11. Upstream commits 5e6313f and fb3b8a0 apply htmlSafe() to the name and cat.name values in filter_rule.volt and nat_rule.volt. Full advisory details are available in GHSA-2xrm-p255-p43h.

Workarounds

Temporarily revoke Firewall Categories and Firewall Alias Edit privileges from non-administrative accounts until the upgrade is applied.
Avoid opening the Firewall Rules and NAT pages from privileged sessions on unpatched instances; use a dedicated low-privilege browser profile for review.
Manually inspect and clean any category or alias text fields that contain quote, angle bracket, or event-handler patterns.

bash

# Upgrade OPNsense to the patched release
opnsense-update -ub
opnsense-update -kr
configctl firmware check
configctl firmware upgrade
# Verify version is 26.1.11 or later
opnsense-version