CVE-2026-49132
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
OPNsense before version 26.1.9 contains a stored cross-site scripting vulnerability in the certificate description field. An authenticated attacker can inject arbitrary HTML or JavaScript via the trust certificate API, and the unsanitized description is rendered in the Dashboard Certificates widget, causing script execution in the browser of any authenticated user.
Risk Assessment
An attacker can hijack user sessions or steal credentials by executing a script in the context of the victim's session on the Dashboard.
Recommendation
Upgrade OPNsense to version 26.1.9 or later, which fixes this vulnerability.
Other vulnerabilities in OPNsense
See all- CVE-2026-45158Critical
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.8, unsanitized user input was passed to the DHCP configuration, allowing remote code execution as root on the underlying operating system.
- CVE-2026-44193Critical
OPNsense is a FreeBSD based firewall and routing platform. In versions prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input, leading to Remote Code Execution.
- CVE-2023-39004Critical
Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password) which could lead to privilege escalation.
- CVE-2026-49131Medium
OPNsense before version 26.1.9 contains a stored cross-site scripting vulnerability in the firewall rule description field. An authenticated attacker with firewall rule management privileges can inject arbitrary HTML or JavaScript via the filter API endpoint, and the unsanitized description is rendered through the default cell formatter in opnsense_bootgrid.js, causing script execution in the browser of any authenticated user.
- CVE-2023-39003High
OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 were found to have insecure permissions on the /tmp directory. This vulnerability could allow a local attacker to access sensitive data or escalate privileges.
Original NVD description (English source)
OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized description value is persisted and later rendered in the Dashboard Certificates widget through Certificates.js, which interpolates the raw value into HTML attribute and text content sinks without encoding, causing injected scripts to execute in the browser of any authenticated user who views the Dashboard, enabling session hijacking or credential theft.