CVE-2026-67189

Received Received - Intake

Stored XSS in pfSense Traffic Graphs Top-Talkers Feature

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description

pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records returned by reverse DNS lookups are incorporated without sanitization into AJAX responses and rendered as HTML through a DOM sink in the administrator interface. An attacker who controls a PTR record and generates sufficient traffic to appear as a top talker can execute arbitrary JavaScript in an administrator's browser, gaining access to the authenticated session context and same-origin access to the firewall management interface, enabling account creation and arbitrary OS command execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-67189

EUVD

EUVD-2026-62699

Affected Vendors & Products

Vendor	Product	Version / Range
netgate	pfsense_plus	to 26.07 (exc)
netgate	pfsense_ce	to 2.8.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in pfSense's Traffic Graphs feature. It occurs when PTR records from reverse DNS lookups are included without sanitization in AJAX responses, which are then rendered as HTML in the administrator interface. An attacker controlling a PTR record and generating enough traffic to appear as a top talker can inject malicious JavaScript into an administrator's browser session.

Detection Guidance

Check if your pfSense version is affected by reviewing the Traffic Graphs page in the web interface. Look for the 'Descriptions' display option in status_graphs.php. If enabled, inspect host descriptions for suspicious JavaScript or HTML content. Monitor network traffic for unusual top talkers with PTR records pointing to attacker-controlled domains.

Impact Analysis

An attacker could gain access to the administrator's authenticated session and same-origin firewall management interface. This enables actions like creating accounts or executing arbitrary OS commands, potentially compromising the entire pfSense system and network.

Mitigation Strategies

Upgrade pfSense Plus to version 26.07 or later and pfSense CE to 2.9.0 or later. If upgrading is not possible, avoid using the 'Descriptions' display option in Traffic Graphs. Use separate browsers for administrative and non-administrative tasks. Disable or restrict access to the DNS Resolver/Forwarder Host Override feature if not needed.

Hi! I’m here to help you understand CVE-2026-67189. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70