CVE-2026-58391
Received Received - Intake

Stored XSS in OPNsense Firewall Rules and NAT Views

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filter_rule.volt and nat_rule.volt without quote-safe encoding. The response layer uses ENT_NOQUOTES, so a double quote survives and closes the attribute, allowing an event-handler attribute to be added to the existing span. A user with Firewall Categories or Firewall Alias Edit privileges can store a category name or alias description; the category must be assigned to a filter or NAT rule, or the alias must be referenced by a rule source or destination, and the rule must be saved so the affected tooltip is rendered. Script then executes in the session of an administrator or other user who opens the affected Rules or NAT page. The script can access CSRF material and perform authenticated actions as the victim. This issue is fixed in version 26.1.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-58391
EUVD
EUVD-2026-102113

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opnsense core < 26.1.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-83 The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-58391 is a stored cross-site scripting (XSS) vulnerability in OPNsense's Firewall Rules and NAT pages. It occurs because tooltip text uses HTML title attributes with attacker-controlled free-text. The htmlspecialchars function leaves double quotes unencoded, allowing attackers to inject event handlers like onanimationstart into tooltips. When users view affected pages, malicious scripts execute in their sessions.

Detection Guidance

To detect this vulnerability, check if your OPNsense version is below 26.1.11 or 26.4.1p1. Log in to the OPNsense web interface and navigate to System > Firmware > Status to verify the installed version. If vulnerable, inspect Firewall Rules and NAT pages for unexpected tooltips or script-like content in category names or alias descriptions.

Impact Analysis

An attacker with low privileges (Firewall Category or Alias Edit) can store malicious JavaScript payloads. When administrators or users view Firewall Rules or NAT pages, the script executes in their session. This can lead to theft of CSRF tokens and execution of authenticated actions on behalf of victims, potentially compromising the firewall's security.

Mitigation Strategies

Immediately update OPNsense to version 26.1.11 or later. If updating is not possible, restrict access to Firewall Categories and Alias Edit privileges to trusted users only. Review existing category names and alias descriptions for malicious payloads before applying the update.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58391. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart