CVE-2026-58390
Received Received - Intake

Stored XSS in OPNsense OpenVPN Dashboard Widget

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client common_name into data-common-name attributes without quote-safe encoding. Exploitation requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register a valid backend username containing a double quote; deployments where the same administrator controls both the identity backend and firewall do not cross a separate trust boundary. An authenticated client using that username can close the attribute and add an event handler, while the local user database is not affected because its username validator rejects quotes. Script executes in an administrator's session when the administrator opens the dashboard or connection-status page and the injected event is triggered; the demonstrated payload used pointer movement over the client row rather than unconditional page-load execution. The advisory demonstrates that the script can read config.xml, invoke privileged APIs, reset the root password, and obtain root command execution. This issue is fixed in version 26.1.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-58390
EUVD
EUVD-2026-102136

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opnsense core < 26.1.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in OPNsense's OpenVPN connection-status dashboard widget. It occurs because the client's common_name is placed into HTML attributes without proper quote-safe encoding. If the common_name contains a double quote, an attacker can inject malicious JavaScript that executes when an administrator views the dashboard or connection-status page.

Detection Guidance

Check OPNsense version with 'opnsense-version' command. If version is below 26.1.11, the system is vulnerable. Inspect OpenVPN connection-status dashboard and pages for unusual client names containing quotes or script tags.

Impact Analysis

An attacker with a valid username containing a double quote can exploit this to execute arbitrary commands as root, steal the full configuration file, reset the root password, and gain persistent access. The attack requires the OpenVPN server to use username-as-common-name with RADIUS or LDAP authentication and the ability to provision such a username.

Mitigation Strategies

Upgrade OPNsense to version 26.1.11 or later immediately. Disable username-as-common-name in OpenVPN server settings if possible. Review and remove any suspicious usernames containing quotes in RADIUS or LDAP backends.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58390. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart