CVE-2026-123025
Received Received - Intake

OS Command Injection in OPNsense os-acme-client Plugin

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: MITRE

Description
An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare() method decodes the dns_gcloud_key model field and directly interpolates the string fields gcloud_account and gcloud_project into a shell command passed to proc_open() via LeUtils::run_shell_command() without any validation or escaping. A remote authenticated user with privileges to issue or renew certificates through the WebGUI/API can achieve arbitrary code execution as root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-123025
EUVD
EUVD-2026-117385

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
OPNsense os-acme-client 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an OS Command Injection vulnerability in the OPNsense os-acme-client plugin through version 4.17. The issue occurs in the Google Cloud DNS validation module where the DnsGcloud::prepare() method decodes and interpolates user-controlled fields (gcloud_account and gcloud_project) directly into a shell command without validation or escaping. This allows a remote authenticated attacker with certificate privileges to execute arbitrary commands as root via proc_open().

Detection Guidance

Check the installed version of the os-acme-client plugin. If it is version 4.17 or earlier, the system is vulnerable. Run 'pkg info os-acme-client' to verify the version.

Impact Analysis

If you use the affected OPNsense os-acme-client plugin versions (up to 4.17), a remote authenticated attacker with certificate management privileges could exploit this to run arbitrary commands on your system with root privileges. This could lead to full system compromise, data theft, or further network infiltration.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, which may violate compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). A successful exploit could result in unauthorized data exposure or modification, triggering regulatory penalties and loss of compliance certifications.

Mitigation Strategies

Upgrade the os-acme-client plugin to version 4.18 or later immediately. This can be done via the OPNsense web interface or by running 'pkg upgrade os-acme-client'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123025. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...