CVE-2026-56126 in pfSense Plus
Summary
by MITRE • 09/03/2026
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date, end-date, start-time, end-time, graph-type, invert, and refresh-interval are concatenated and written to the global pfSense XML configuration without sanitization, then echoed unsanitized into a JavaScript string context on page render. Because the setting is stored in the global configuration, the payload executes in the browser of every user who visits the Status: Monitoring page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified involves a critical Stored Cross-Site Scripting (XSS) flaw within pfSense Plus versions prior to 26.07 and pfSense CE versions prior to 2.9.0. This security issue stems from insufficient input validation and sanitization mechanisms when handling graph configuration parameters in the status monitoring interface. Specifically, the application accepts multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date, end-date, start-time, end-time, graph-type, invert, and refresh-interval. These inputs are concatenated directly into a global pfSense XML configuration file without any sanitization checks to filter out malicious content or escape special characters that could be interpreted as executable code by the browser.
The technical root cause lies in how these unsanitized parameters are subsequently rendered on the server side. When an administrator with Status: Monitoring privileges accesses the /status_monitoring.php endpoint, the application reads the stored configuration and echoes it directly into a JavaScript string context within the page's HTML structure. Because the data is not properly encoded or escaped before being embedded in the script block, any malicious payload injected during the initial POST request becomes part of the executable code base for that specific graph configuration. This architectural flaw allows an attacker to inject arbitrary JavaScript code that will be executed by the browser whenever the affected page is loaded.
The operational impact of this vulnerability is severe due to its stored nature and broad scope. Unlike reflected XSS, where a payload must be delivered via a crafted link or form submission for each victim, this vulnerability persists in the server-side configuration. Consequently, once an authenticated user with sufficient privileges injects malicious JavaScript, that code executes automatically in the browser of every subsequent user who visits the Status: Monitoring page. This includes other administrators and potentially users with lower privilege levels if they have access to view system status information. The ability to execute arbitrary scripts enables attackers to perform session hijacking by stealing authentication cookies or tokens, conduct phishing attacks within the context of the trusted pfSense interface, deface the web UI, or pivot further into the internal network by using the compromised browser as a proxy for attacking other resources accessible from that machine.
From an industry standard perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves storing untrusted data in a database or configuration file and later retrieving it without proper validation before rendering it to users, which also maps closely to CWE-83 Injection while the persistence aspect relates to stored XSS patterns often documented in OWASP Top 10 resources. In terms of adversary tactics, this flaw facilitates initial access and credential harvesting as described in MITRE ATT&CK techniques such as T1556 Modifying Authentication Process or T1078 Valid Accounts if used for session theft, allowing attackers to maintain persistence within the network perimeter by compromising administrative credentials through browser-based attacks.
Mitigation strategies require immediate action to address both the technical flaw and access controls. The primary remediation is to upgrade pfSense Plus to version 26.07 or later and pfSense CE to version 2.9.0 or later, where these input validation issues have been resolved by implementing strict sanitization routines that escape special characters before writing them to XML configurations and rendering them in JavaScript contexts. For environments unable to patch immediately due to operational constraints, administrators should restrict access to the Status: Monitoring page exclusively to trusted IP addresses using firewall rules if possible, although this is less effective than a code fix since authenticated sessions are required. Additionally, implementing Content Security Policy headers can help mitigate the impact of any residual XSS vulnerabilities by restricting the sources from which scripts can be loaded and executed, thereby reducing the effectiveness of injected payloads even if they bypass other defenses. Regular auditing of configuration files for unexpected content changes can also aid in early detection of exploitation attempts before widespread compromise occurs.