CVE-2026-49132

Received Received - Intake

Stored XSS in OPNsense Dashboard via Certificate Description

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulnCheck

Description

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized description value is persisted and later rendered in the Dashboard Certificates widget through Certificates.js, which interpolates the raw value into HTML attribute and text content sinks without encoding, causing injected scripts to execute in the browser of any authenticated user who views the Dashboard, enabling session hijacking or credential theft.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-03

Generated

2026-08-04

AI Q&A

2026-08-04

EPSS Evaluated

N/A

NVD

CVE-2026-49132

EUVD

EUVD-2026-52433

Affected Vendors & Products

Vendor	Product	Version / Range
opnsense	opnsense	to 26.1.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

OPNsense before version 26.1.9 has a stored cross-site scripting (XSS) vulnerability. Authenticated attackers can inject malicious HTML or JavaScript by inserting payloads into the certificate description field through the trust certificate API. The unsanitized input is saved and later displayed in the Dashboard Certificates widget via Certificates.js, which embeds the raw value into HTML without proper encoding. This allows scripts to execute in the browsers of authenticated users viewing the dashboard, potentially leading to session hijacking or credential theft.

Detection Guidance

Check OPNsense versions before 26.1.9 for vulnerable certificate descriptions. Inspect browser console logs for unexpected scripts in the Dashboard Certificates widget. Look for unsanitized HTML or JavaScript payloads in certificate descriptions via the trust certificate API.

Impact Analysis

If you are an authenticated OPNsense user, an attacker could exploit this to steal your session cookies or login credentials by injecting malicious scripts. This could allow unauthorized access to your OPNsense dashboard or other sensitive systems. The attack requires authentication, so it primarily affects users with existing access to the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection requirements or HIPAA's security rules for protected health information. Organizations using vulnerable OPNsense versions may face compliance violations if user credentials or session data are compromised through this XSS flaw.

Mitigation Strategies

Upgrade OPNsense to version 26.1.9 or later. Review and sanitize all certificate descriptions in the trust certificate API. Remove any suspicious or untrusted certificates. Monitor Dashboard Certificates widget for unexpected behavior.

Hi! I’m here to help you understand CVE-2026-49132. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70