CVE-2026-49132 in OPNsense
Summary
by MITRE • 08/04/2026
OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized description value is persisted and later rendered in the Dashboard Certificates widget through Certificates.js, which interpolates the raw value into HTML attribute and text content sinks without encoding, causing injected scripts to execute in the browser of any authenticated user who views the Dashboard, enabling session hijacking or credential theft.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
This vulnerability exists within OPNsense versions prior to 26.1.9 and represents a critical stored cross-site scripting flaw that affects the certificate management functionality of the system. The issue stems from insufficient input validation and output encoding within the trust certificate API component, where attackers with authenticated access can manipulate certificate description fields to inject malicious payloads. The vulnerability is particularly dangerous because it allows attackers to execute arbitrary JavaScript code in the browser context of any authenticated user who views the dashboard certificates widget.
The technical implementation of this flaw involves multiple layers of security bypass. When an attacker submits a certificate description containing malicious HTML or JavaScript through the trust certificate API, the system fails to properly sanitize this input before storing it in the database. Subsequently, when the Dashboard Certificates widget loads, the JavaScript file Certificates.js retrieves these unsanitized values and directly interpolates them into HTML attribute and text content sinks without appropriate encoding or escaping mechanisms. This direct injection pattern follows the CWE-79 classification for cross-site scripting vulnerabilities, specifically demonstrating poor input validation and output encoding practices that enable malicious code execution.
The operational impact of this vulnerability is severe as it provides attackers with persistent access to authenticated user sessions within the OPNsense interface. Any user who views the dashboard certificates widget becomes a potential victim of session hijacking attacks, where attackers can steal session cookies or credentials from the target's browser context. This creates an ideal environment for privilege escalation attacks, as the malicious code executes in the context of the victim's authenticated session with full administrative privileges. The vulnerability affects all authenticated users who have access to the dashboard interface, making it particularly dangerous in multi-user environments where administrators frequently monitor certificate status.
The attack vector requires only authenticated access to the system, which significantly lowers the barrier for exploitation. Attackers can leverage this weakness through legitimate administrative functions without requiring additional authorization or complex attack chains. The persistence of the vulnerability means that once a malicious payload is injected, it continues to affect users until the system is patched and the stored data is cleared. Organizations should implement immediate mitigation measures including applying the 26.1.9 update, reviewing existing certificate entries for potential malicious payloads, and monitoring user sessions for suspicious activity. The vulnerability demonstrates the critical importance of input sanitization and output encoding in web applications, aligning with ATT&CK technique T1059.007 for script injection attacks that exploit insecure data handling practices in web interfaces.