CVE-2026-123025 in os-acme-client Plugin
Summary
by MITRE • 11/05/2026
An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare() method decodes the dns_gcloud_key model field and directly interpolates the string fields gcloud_account and gcloud_project into a shell command passed to proc_open() via LeUtils::run_shell_command() without any validation or escaping. A remote authenticated user with privileges to issue or renew certificates through the WebGUI/API can achieve arbitrary code execution as root.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in the OPNsense os-acme-client plugin, specifically within versions up to 4.17, represents a critical OS Command Injection flaw located in the Google Cloud DNS validation module. This security defect is rooted in the improper handling of user-supplied input during the certificate issuance and renewal processes facilitated by the ACME protocol implementation. The core technical failure occurs within the DnsGcloud::prepare() method, which is responsible for configuring the environment required to interact with Google Cloud services for domain ownership verification. During this preparation phase, the system retrieves configuration data from the model field dns_gcloud_key and proceeds to decode it without implementing sufficient sanitization checks on subsequent string fields such as gcloud_account and gcloud_project. These values are then directly interpolated into a shell command string that is subsequently passed to LeUtils::run_shell_command(), which utilizes PHP's proc_open function to execute system-level commands. Because there is no validation or escaping applied to these inputs before they enter the command execution pipeline, an attacker can inject arbitrary operating system commands by manipulating the content of these configuration fields.
The operational impact of this vulnerability is severe due to the privilege level at which the affected code executes. The OPNsense firewall appliance typically runs its web interface and associated plugins under a privileged context that allows for significant system modifications. Consequently, an authenticated user who possesses the necessary permissions to issue or renew SSL certificates through the WebGUI or API can exploit this command injection flaw to achieve arbitrary code execution with root privileges. This effectively bypasses all access controls within the OPNsense environment, allowing the attacker to fully compromise the firewall appliance. Once root access is obtained, an adversary could exfiltrate sensitive network data, modify firewall rules to facilitate lateral movement, install persistent backdoors, or use the compromised device as a pivot point for further attacks against internal networks. This scenario aligns with Common Weakness Enumeration CWE-78, which classifies improper neutralization of special elements used in an OS command, and maps directly to MITRE ATT&CK technique T1059, specifically sub-techniques related to command and script interpreters such as PowerShell or Unix Shell execution.
Mitigation strategies for this vulnerability require immediate action from system administrators managing OPNsense installations with the os-acme-client plugin installed. The primary remediation step is to update the opnsense-os-acme-client package to version 4.18 or later, where the developers have implemented proper input validation and escaping mechanisms before passing variables to shell commands. Until an upgrade can be performed, administrators should restrict access to the certificate management interface by limiting WebGUI and API permissions to only those users who absolutely require it for their operational duties. Additionally, implementing network-level segmentation to isolate the firewall's management interface from untrusted networks can reduce the attack surface available to potential attackers attempting to exploit this flaw via remote authentication vectors. Regular auditing of plugin versions and adherence to vendor security advisories are essential practices for maintaining the integrity of critical infrastructure components like firewalls that serve as gateways between trusted internal networks and external internet traffic.