Read the docs
TI-2026-74821 Aliases CVE-2026-58391

Stored cross-site scripting in OPNsense Firewall Rules and NAT pages

Priority MEDIUM 58CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

OPNsense core before 26.1.11 writes stored firewall category names and alias descriptions into HTML title attributes on the Rules and NAT pages without quote-safe encoding (CWE-79). An authenticated user with Firewall Categories or Firewall Alias Edit privileges can break out of the attribute and add a script event handler. The script runs for an administrator or other user who opens the affected page and can act as that victim, including reading CSRF material.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filter_rule.volt and nat_rule.volt without quote-safe encoding. The response layer uses ENT_NOQUOTES, so a double quote survives and closes the attribute, allowing an event-handler attribute to be added to the existing span. A user with Firewall Categories or Firewall Alias Edit privileges can store a category name or alias description; the category must be assigned to a filter or NAT rule, or the alias must be referenced by a rule source or destination, and the rule must be saved so the affected tooltip is rendered. Script then executes in the session of an administrator or other user who opens the affected Rules or NAT page. The script can access CSRF material and perform authenticated actions as the victim. This issue is fixed in version 26.1.11.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00274 19th percentileScored 2026-11-09
Fix Fixed core (opnsense): 26.1.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
opnsensecorebefore 26.1.1126.1.11Patch availableCNA
  • core Vendoropnsense Affected before 26.1.11 Fixed in 26.1.11 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*——opnsense
  • cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:* Versions — — ·opnsense

Remediation

Update OPNsense core to version 26.1.11, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA core (opnsense) Fixed in 26.1.11

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-58391
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-20 CISA SSVC decision points changed
  4. 2026-10-20 Priority changed: LOW → MEDIUM

References

Other 4

  • TI-2023-20247 A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense… CVSS 3.1CRITICAL 9.8
  • TI-2023-20243 Insecure permissions in the configuration directory (/conf/) of OPNsense Community… CVSS 3.1CRITICAL 9.8
  • TI-2023-20240 A command injection vulnerability in the component diag_backup.php of OPNsense Community… CVSS 3.1CRITICAL 9.8
  • TI-2023-11947 DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers… CVSS 3.1CRITICAL 9.8
  • TI-2026-74819 Path traversal in OPNsense GeoIP importer allows root code execution CVSS 3.1CRITICAL 9.9
  • TI-2023-20246 /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and… CVSS 3.1CRITICAL 9.6
See all 54 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences