CVE-2026-58394: OPNsense Firewall XSS Vulnerability

CVE-2026-58394 Overview

CVE-2026-58394 is a stored cross-site scripting (XSS) vulnerability in OPNsense, a FreeBSD-based firewall and routing platform. The flaw exists in src/www/system_advanced_admin.php, which reads certificate records into the $a_cert array but omits that array from legacy_html_escape_form_data() before rendering certificate descr values in the SSL Certificate selector. An authenticated user with the page-system-certmanager privilege can store HTML markup in a certificate description. The payload executes when another user opens System Settings Administration. The issue is fixed in version 26.1.11.

Critical Impact
An authenticated attacker with certificate manager privileges can inject script that runs in another administrator's browser session, enabling actions within the OPNsense web interface.

Affected Products

OPNsense versions prior to 26.1.11
src/www/system_advanced_admin.php component
SSL Certificate selector rendering in System Settings Administration

Discovery Timeline

2026-10-15 - CVE-2026-58394 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-58394

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw classified under [CWE-79]. The system_advanced_admin.php page renders certificate records in a dropdown selector within the System Settings Administration view. Before rendering, the page escapes values from $pconfig and $a_group by calling legacy_html_escape_form_data(), but the $a_cert array is omitted from that call. Certificate description fields accept HTML metacharacters, so stored markup is inserted directly into the rendered HTML.

Exploitation requires an account with the page-system-certmanager privilege. That user stores a crafted certificate description containing JavaScript. When any administrator subsequently opens System Settings Administration, the browser parses and executes the injected markup under the OPNsense session context.

Root Cause

The root cause is missing output encoding for a specific data array. The function legacy_html_escape_form_data() neutralizes HTML metacharacters, but the developer did not invoke it on $a_cert prior to inclusion in the template. The certificate descr field is user-controlled and lacks input-side sanitization, so unescaped markup reaches the DOM.

Attack Vector

The attack requires network access to the OPNsense web interface and valid credentials with the certificate manager privilege. The attacker creates or edits a certificate and places script content in the description. A separate privileged user triggers execution by navigating to System Settings Administration.

php

// Patch for src/www/system_advanced_admin.php
 legacy_html_escape_form_data($pconfig);
 legacy_html_escape_form_data($a_group);
+legacy_html_escape_form_data($a_cert);
 
 include("head.inc");

Source: OPNsense core commit 9d0a590. The patch adds the missing call to legacy_html_escape_form_data($a_cert) so certificate fields are HTML-escaped before output.

Detection Methods for CVE-2026-58394

Indicators of Compromise

Certificate records whose descr field contains HTML tags, <script> elements, event handler attributes such as onerror=, or javascript: URIs.
Unexpected administrative changes to OPNsense configuration shortly after an administrator opens system_advanced_admin.php.
Audit log entries showing creation or modification of certificates by accounts holding only the page-system-certmanager privilege.

Detection Strategies

Inspect config.xml or the certificate store for descr values containing angle brackets, quotes, or script-like substrings.
Review web server access logs for repeated requests to /system_advanced_admin.php correlated with privileged user sessions.
Compare current OPNsense version against 26.1.11 to confirm patch status across all firewall instances.

Monitoring Recommendations

Alert on configuration changes performed by non-administrator accounts, including certificate creation and edits.
Monitor browser-side telemetry for script execution originating from the OPNsense management interface.
Track issuance of the page-system-certmanager privilege and periodically review which accounts hold it.

How to Mitigate CVE-2026-58394

Immediate Actions Required

Upgrade OPNsense to version 26.1.11 or later on all firewall and routing appliances.
Audit existing certificate descr fields and remove any entries containing HTML or script content before upgrading.
Restrict the page-system-certmanager privilege to a minimal set of trusted operators.

Patch Information

The fix is included in OPNsense 26.1.11. The upstream commits 9d0a590 and adcb02f add legacy_html_escape_form_data($a_cert) to src/www/system_advanced_admin.php. See the GitHub Security Advisory GHSA-8pgr-x852-qx4j for the vendor record.

Workarounds

Revoke the page-system-certmanager privilege from untrusted users until the patch is applied.
Avoid opening System Settings Administration from accounts that do not need routine access to that page.
Enforce administrative access to the OPNsense web UI from dedicated management hosts to reduce exposure of session cookies.

bash

# Upgrade OPNsense from the console or SSH shell
opnsense-update -u
opnsense-update -r 26.1.11