CVE-2026-58394
Received Received - Intake

Stored XSS in OPNsense Admin Certificate Selector

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration. This issue is fixed in version 26.1.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-58394
EUVD
EUVD-2026-102135

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opnsense core < 26.1.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-58394 is a stored cross-site scripting (XSS) vulnerability in OPNsense affecting versions up to 26.1.10 and 26.4.1. The issue occurs in the Administration Settings page where the SSL Certificate selector renders certificate descriptions without proper HTML escaping. An attacker with certificate-management privileges can inject malicious scripts into certificate descriptions. When an administrator views the Administration page, the stored script executes in their session.

Detection Guidance

Check OPNsense versions prior to 26.1.11 or 26.4.1p1 for the vulnerability. Inspect system_advanced_admin.php for missing legacy_html_escape_form_data calls on $a_cert. Look for certificate descriptions containing HTML metacharacters or script tags in the SSL Certificate selector.

Impact Analysis

This vulnerability allows an attacker to execute malicious scripts in the context of an administrator's session. This could lead to theft of CSRF tokens or execution of authenticated actions, potentially compromising the OPNsense firewall or routing platform.

Mitigation Strategies

Upgrade OPNsense to version 26.1.11 or later. If upgrading is not immediately possible, review and remove any suspicious certificate descriptions containing HTML or script payloads. Ensure all user inputs are properly escaped before rendering in the web interface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58394. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart