CVE-2026-58391 in OPNsense
Summary
by MITRE • 10/15/2026
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filter_rule.volt and nat_rule.volt without quote-safe encoding. The response layer uses ENT_NOQUOTES, so a double quote survives and closes the attribute, allowing an event-handler attribute to be added to the existing span. A user with Firewall Categories or Firewall Alias Edit privileges can store a category name or alias description; the category must be assigned to a filter or NAT rule, or the alias must be referenced by a rule source or destination, and the rule must be saved so the affected tooltip is rendered. Script then executes in the session of an administrator or other user who opens the affected Rules or NAT page. The script can access CSRF material and perform authenticated actions as the victim. This issue is fixed in version 26.1.11.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/15/2026
OPNsense, a widely deployed firewall and routing platform based on FreeBSD, contains a stored cross-site scripting vulnerability within its web interface prior to version 26.1.11. The flaw resides specifically in the rendering of Firewall Rules and Network Address Translation views, where category names and alias descriptions are inserted directly into HTML title attributes without proper quote-safe encoding. This implementation detail allows an attacker with specific privileges to inject malicious script payloads that persist within the system's configuration data rather than being transiently passed via URL parameters or form fields.
The technical mechanism of exploitation relies on the response layer utilizing ENT_NOQUOTES for output escaping, which fails to encode double quotes. Consequently, a crafted category name or alias description containing a closing double quote can terminate the title attribute prematurely. This structural break enables the injection of additional HTML attributes, such as event handlers like onclick or onload, directly into existing span elements that display tooltips. For this vulnerability to be triggered, an attacker must possess Firewall Categories or Firewall Alias Edit privileges and successfully store a malicious payload within these fields. Furthermore, the injected content must be actively referenced by saving it to a filter rule or NAT rule where it serves as part of the source or destination configuration, ensuring the affected tooltip is rendered in the user interface.
The operational impact of this vulnerability is significant for any administrator or privileged user who accesses the Rules or NAT pages while viewing entries containing the malicious payload. When such a user opens the page to view details, their browser executes the injected script within their own session context. This execution grants the attacker the ability to access sensitive Cross-Site Request Forgery tokens and other authentication materials stored in the client-side environment. As a result, an attacker can perform authenticated actions on behalf of the victim, potentially modifying firewall rules, altering network configurations, or escalating privileges without further interaction from the target user.
This vulnerability is classified under CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. From a tactical perspective, it aligns with MITRE ATT&CK techniques related to Client-side Injection and potentially Credential Access through browser session manipulation. The risk is mitigated by upgrading OPNsense to version 26.1.11 or later, where the output encoding logic has been corrected to properly escape special characters including double quotes within HTML attributes. Until such an upgrade is performed, administrators should exercise extreme caution when viewing rules associated with aliases or categories created by untrusted users and consider restricting edit privileges for firewall objects to only those personnel who require it for operational necessity.