OPNsense: Stored XSS in OpenVPN status views leads to root code execution
Summary
The OpenVPN connection-status dashboard widget and status view of OPNsense insert the client common_name into HTML attributes without proper encoding. An authenticated VPN user whose backend account name contains a double quote can inject script that runs in an administrator's session when the administrator opens the dashboard or status page and triggers the injected event. The advisory demonstrates that this allows reading config.xml, calling privileged APIs, resetting the root password and executing commands as root. The attack requires an OpenVPN server using username-as-common-name with RADIUS or LDAP authentication and a backend where an attacker can create such an account.
Affected
- OPNsense core before 26.1.11 (26.1.x branch, per the CVE record and GHSA up to 26.1.10)
- OPNsense 26.4.x branch up to 26.4.1 (per the GHSA advisory; not listed in the CVE record)
- Only deployments using OpenVPN with username-as-common-name and RADIUS or LDAP authentication are exposed
Fixed in
- OPNsense 26.1.11 (26.1.x branch)
- OPNsense 26.4.1p1 (26.4.x branch, per the GHSA advisory)
Workaround
- Unknown. No vendor-documented workaround was found; applying the update is the fix.
- Interim: restrict access to the OPNsense web GUI and limit who can create or self-register accounts in the RADIUS or LDAP backend.
Exploitation
- The vendor advisory includes a reproduction on OPNsense 26.1.9, demonstrated with pointer movement over the client row.
- CISA SSVC lists exploitation as PoC, automatable as no.
- Sources conflict on exploitation status; no confirmed in-the-wild exploitation was found and CISA KEV listing could not be confirmed.
Our recommendation
- Identify all OPNsense instances and their exact version and branch.
- Update to 26.1.11 or 26.4.1p1 as appropriate.
- If OpenVPN uses RADIUS or LDAP with username-as-common-name, review who can create accounts in that backend.
- Restrict GUI access to administrators and check CISA KEV and the GHSA advisory again before closing.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-26cj-h9rj-g5pf github.com
- Fix commit 11180da (status.volt, OpenVPNClients.js) github.com
- Fix commit e7b2ac8 (status.volt, OpenVPNClients.js) github.com
- OpenCVE entry CVE-2026-58390 app.opencve.io
- Mend/Vulners CVE-2026-58390 (CVSS 4.0) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:17.
Original description (NVD)
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client common_name into data-common-name attributes without quote-safe encoding. Exploitation requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register a valid backend username containing a double quote; deployments where the same administrator controls both the identity backend and firewall do not cross a separate trust boundary. An authenticated client using that username can close the attribute and add an event handler, while the local user database is not affected because its username validator rejects quotes. Script executes in an administrator's session when the administrator opens the dashboard or connection-status page and the injected event is triggered; the demonstrated payload used pointer movement over the client row rather than unconditional page-load execution. The advisory demonstrates that the script can read config.xml, invoke privileged APIs, reset the root password, and obtain root command execution. This issue is fixed in version 26.1.11.
NVD references (4)
- https://github.com/opnsense/core/commit/11180daf579879d84d91a7fbea7a59320bc80868
- https://github.com/opnsense/core/commit/e7b2ac8093f804bef8eb88dfa9a0d99fad00c12b
- https://github.com/opnsense/core/security/advisories/GHSA-26cj-h9rj-g5pf
- https://github.com/opnsense/core/security/advisories/GHSA-26cj-h9rj-g5pf
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.