CVE-2026-67189: pfSense Stored XSS Vulnerability

CVE-2026-67189 Overview

CVE-2026-67189 is a stored cross-site scripting (XSS) vulnerability in pfSense Plus before 26.07 and pfSense CE through 2.8.1. The flaw resides in the Traffic Graphs top-talkers feature of the administrator web interface. PTR records returned by reverse DNS lookups are incorporated into AJAX responses without sanitization and rendered as HTML through a DOM sink. An attacker who controls a PTR record for a host generating enough traffic to appear as a top talker can execute arbitrary JavaScript in the administrator's browser. The classification is [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation grants same-origin access to the firewall management interface, enabling administrator account creation and arbitrary operating system command execution on the firewall.

Affected Products

pfSense Plus versions before 26.07
pfSense CE versions through 2.8.1
Netgate firewall appliances running affected pfSense builds

Discovery Timeline

2026-08-19 - CVE-2026-67189 published to the National Vulnerability Database
2026-08-19 - Last updated in the NVD database

Technical Details for CVE-2026-67189

Vulnerability Analysis

The Traffic Graphs feature in pfSense periodically requests top-talker data through an AJAX endpoint in the administrator interface. To make the output human-readable, the backend performs reverse DNS lookups on the source and destination IP addresses observed in traffic flows. The PTR record returned for each address is included in the JSON payload sent to the administrator's browser. The frontend then writes those values into the DOM using a sink that treats the string as HTML rather than as text. Because PTR records can contain arbitrary characters chosen by the owner of the reverse DNS zone, an attacker who controls the PTR record for a host under their control can embed script content that executes in the administrator's session.

Root Cause

The root cause is missing output encoding on data sourced from an untrusted third party. The application implicitly trusts PTR record contents returned from external DNS resolvers. No HTML entity encoding, allowlist validation, or safe DOM insertion method is applied before the value is rendered inside the administrator interface.

Attack Vector

Exploitation requires the attacker to control a PTR record for an IP address that will appear in the Traffic Graphs top-talkers list. The attacker configures the PTR record with a payload such as an HTML tag containing JavaScript. The attacker then generates enough inbound or outbound traffic against the target firewall to rank as a top talker. When an administrator loads the Traffic Graphs page, the reverse lookup returns the malicious PTR value and the AJAX handler renders it as HTML. Script execution occurs in the authenticated administrator context, allowing the attacker to invoke privileged endpoints, create new administrator accounts, and issue commands that run at the operating system level on the firewall. User interaction from an administrator is required, consistent with the CVSS 4.0 vector component UI:P.

No verified public exploit code is available for CVE-2026-67189 at this time. See the VulnCheck Advisory on pfSense XSS and the Netgate Security Advisory for further technical detail.

Detection Methods for CVE-2026-67189

Indicators of Compromise

Unexpected administrator accounts appearing in the pfSense user database or /cf/conf/config.xml.
PTR records observed in DNS query responses containing HTML tags, angle brackets, or JavaScript keywords such as <script>, onerror=, or onload=.
Outbound connections from the firewall host to attacker-controlled infrastructure shortly after an administrator visits the Traffic Graphs page.
New or modified entries in /etc/rc.conf.local, cron jobs, or firewall rule sets that were not authorized.

Detection Strategies

Inspect nginx and PHP access logs for AJAX requests to the Traffic Graphs endpoint followed by unexpected privileged API calls in the same administrator session.
Monitor DNS resolver logs for PTR responses containing characters not valid in hostnames per RFC 1035, such as <, >, ", or /.
Correlate administrator authentication events with the creation of new user accounts, group membership changes, and shell command invocations via diag_command.php.

Monitoring Recommendations

Forward pfSense system, authentication, and web server logs to a centralized log platform for retention and correlation.
Alert on any modification to the pfSense config.xml outside of scheduled change windows.
Baseline the set of administrator accounts and generate alerts when the count changes.

How to Mitigate CVE-2026-67189

Immediate Actions Required

Upgrade pfSense Plus to version 26.07 or later, and pfSense CE to version 2.9.0 or later, following the pfSense Release Notes 26.07 and pfSense Release Notes 2.9.0.
Audit all administrator and privileged accounts on affected firewalls and remove any that were not explicitly authorized.
Rotate credentials, API keys, and shared secrets stored on the firewall if compromise is suspected.

Patch Information

Netgate has released fixed builds that sanitize PTR record output before rendering. Refer to the Netgate Security Advisory for the authoritative fix reference. Apply the update through the pfSense System Update mechanism or by installing the patched image on the appliance.

Workarounds

Disable the Traffic Graphs top-talkers view in the administrator interface until the patch is applied.
Disable reverse DNS resolution for Traffic Graphs so that PTR records are not incorporated into the AJAX response.
Restrict access to the pfSense web management interface to a dedicated management network reachable only from trusted administrator workstations.
Use an isolated browser profile for firewall administration to reduce the value of any session hijacked through XSS.

bash

# Configuration example: restrict access to the management interface
# Firewall rule (WebConfigurator anti-lockout replacement) — allow only management subnet
# Apply under Firewall > Rules > MGMT interface
# Action: Pass
# Interface: MGMT
# Protocol: TCP
# Source: 10.10.0.0/24  (trusted admin subnet)
# Destination: This Firewall (self)
# Destination Port: 443 (HTTPS)
# Description: Allow admin subnet to WebGUI

# Then add a block rule for all other sources to the WebGUI port
# Action: Block
# Source: any
# Destination: This Firewall (self)
# Destination Port: 443