Key points
- CVE-2026-58390 affects OPNsense versions prior to 26.1.11 and is rated high severity.
- The flaw allows authenticated clients to inject scripts into the OpenVPN status widget.
- Attackers can potentially read configuration files and reset root passwords.
OPNsense versions older than 26.1.11 contain a high-severity vulnerability that allows attackers to execute malicious code. The National Vulnerability Database records this issue as CVE-2026-58390. It affects the OpenVPN connection-status dashboard widget. The flaw exists because the software fails to encode data safely. This allows scripts to run in an administrator's browser session.
In plain English
The problem occurs in the web interface where administrators view OpenVPN connections. The system places client names into the page code without proper safety checks. An attacker can create a username containing a double quote. This special character breaks the code structure. The attacker then adds their own commands to the page. These commands run when the administrator views the dashboard.
The background
Exploitation requires specific conditions to be met. The OpenVPN server must use username-as-common-name settings. It also needs RADIUS or LDAP authentication. The attacker must have a valid backend username. They need the ability to provision or self-register this account. The username must contain a double quote. Local user databases are not affected because they reject quotes.
What changes now
OPNsense has released version 26.1.11 to fix this issue. This update addresses the unsafe encoding in the OpenVPN widget. Administrators should update their systems to this version. The patch prevents the injection of malicious scripts. It stops attackers from accessing the configuration file. It also blocks attempts to reset root passwords.
Who needs to act first
Teams usually prioritize systems that face external networks. Check whether your firewall uses RADIUS or LDAP for OpenVPN. Verify if users can create their own accounts. Review the OpenVPN settings for common-name usage. Back up your configuration before applying updates. Test the new version in a safe environment first. Roll out the fix to production systems after testing. Monitor logs for unusual activity during the transition.
What to do and how to stay safe: OPNsense
- Verify your current OPNsense version and compare it to 26.1.11.
- Update your firewall to the latest patched version immediately.
- Review OpenVPN authentication settings to ensure proper security.
- Monitor administrator sessions for unexpected script executions.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-58390?
It is a high-severity cross-site scripting vulnerability in OPNsense that allows code execution via the OpenVPN dashboard.
Which versions are affected?
All OPNsense versions prior to 26.1.11 are affected by this vulnerability.
Is there a fix available?
Yes, the issue is fixed in OPNsense version 26.1.11.
