Read the docs
TI-2026-85374 Aliases CVE-2026-123025GHSA-g9hg-38vq-jvh9

OS command injection in OPNsense os-acme-client Google Cloud DNS

Priority MEDIUM 41CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

The OPNsense os-acme-client plugin through 4.17.0 contains an OS command injection flaw in its Google Cloud DNS validation code (CWE-78). Account and project values are inserted into a shell command without validation or escaping. A remote authenticated user with privileges to issue or renew certificates through the WebGUI or API can run arbitrary code as root.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare() method decodes the dns_gcloud_key model field and directly interpolates the string fields gcloud_account and gcloud_project into a shell command passed to proc_open() via LeUtils::run_shell_command() without any validation or escaping. A remote authenticated user with privileges to issue or renew certificates through the WebGUI/API can achieve arbitrary code execution as root.

Why it matters now

EPSS 0.0063 50th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
opnsenseos-acme-clientup to 4.17.0—No fix listedCNA
  • os-acme-client Vendoropnsense Affected up to 4.17.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for os-acme-client.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-123025
  2. 2026-11-05 Alias added: GHSA-g9hg-38vq-jvh9

References

Other 1

  • TI-2023-20247 A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense… CVSS 3.1CRITICAL 9.8
  • TI-2023-20243 Insecure permissions in the configuration directory (/conf/) of OPNsense Community… CVSS 3.1CRITICAL 9.8
  • TI-2023-20240 A command injection vulnerability in the component diag_backup.php of OPNsense Community… CVSS 3.1CRITICAL 9.8
  • TI-2023-11947 DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers… CVSS 3.1CRITICAL 9.8
  • TI-2026-74819 Path traversal in OPNsense GeoIP importer allows root code execution CVSS 3.1CRITICAL 9.9
  • TI-2023-20246 /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and… CVSS 3.1CRITICAL 9.6
See all 54 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences