OPNsense XSS Flaw Allows Admin Session Hijack via OpenVPN Widget

OPNsense firewall deployments running versions older than 26.1.11 are vulnerable to a high-severity cross-site scripting flaw identified as CVE-2026-58390. The vulnerability exists in the OpenVPN connection-status dashboard widget and view, where client data is rendered without proper encoding, allowing malicious script injection.

What happened

The vulnerability stems from how OPNsense handles client identification data in its web interface. According to the NVD record, the OpenVPN connection-status dashboard widget and the connection-status view place a client common_name into data-common-name attributes without quote-safe encoding. This occurs in the JavaScript file src/opnsense/www/js/widgets/OpenVPNClients.js.

Exploitation is not possible in all deployments. The advisory states that successful abuse requires an OpenVPN server configured to use username-as-common-name along with RADIUS or LDAP authentication. Furthermore, the attacker must have the ability to provision or self-register a valid backend username that contains a double quote character.

Deployments where the same administrator controls both the identity backend and the firewall do not cross a separate trust boundary for this attack. The local user database is not affected because its username validator rejects quotes. An authenticated client using a specially crafted username can close the HTML attribute and add an event handler.

The script executes in an administrator's session when the administrator opens the dashboard or connection-status page. The demonstrated payload used pointer movement over the client row rather than unconditional page-load execution. This means the malicious code runs only when the administrator interacts with the specific UI element containing the injected data.

Why it matters

The security implications of this flaw extend beyond typical cookie theft. The advisory demonstrates that the injected script can read the sensitive config.xml file and invoke privileged APIs. This level of access allows an attacker to reset the root password and obtain root command execution on the firewall device.

Because the code executes in the administrator's browser session, it leverages the privileges already granted to that user. The CVSS score for CVE-2026-58390 is rated as High by the NVD. This rating reflects the severity of the potential impact, including complete system compromise, despite the specific prerequisites required for exploitation.

The flaw is classified under CWE-79, which denotes Improper Neutralization of Input During Web Page Generation. This weakness allows an attacker to inject client-side scripts into pages viewed by other users. In this case, the "other user" is the privileged administrator managing the firewall, making the impact significantly more severe than standard XSS attacks.

Our take on the response

• OPNsense released version 26.1.11 to fix this issue.
• Users should verify their current version against the affected range.
• Administrators should update their systems to version 26.1.11 or later.
• Teams should review their OpenVPN authentication methods to understand their exposure.

What defenders should look for

Security operations teams should monitor for unusual JavaScript errors or console logs originating from the OPNsense web interface. Look for requests from administrator sessions that immediately follow interactions with OpenVPN client lists. Check for outbound connections to unexpected domains from the administrator's workstation, which may indicate data exfiltration. Investigate any sudden changes to root passwords or configuration files that do not match change management records. Review web server logs for requests containing unusual characters in query parameters or headers, specifically looking for encoded quote characters.

Background: Data exfiltration

Data exfiltration is the unauthorized transfer of information from a computer or network to an external recipient. It occurs when attackers move sensitive files, credentials, or databases out of your control. Understanding the methods helps you spot the subtle signs of data leaving your environment without triggering standard alarms.

Read the full guide: Data Exfiltration Explained: How Data Leaves Your Network

What to do and how to stay safe: OPNsense

• Verify if your OPNsense installation is running a version older than 26.1.11 and plan an update.
• Audit your OpenVPN server configuration to determine if it uses username-as-common-name with external authentication.
• Review identity backend logs for any recently created usernames containing special characters like double quotes.
• Once the vendor provides an update, apply it promptly to patch the encoding flaw in the web interface.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which OPNsense versions are affected by CVE-2026-58390?

All OPNsense core versions prior to 26.1.11 are affected by this vulnerability.

Is a fix available for this cross-site scripting flaw?

Yes, the issue is fixed in version 26.1.11 of OPNsense.

What specific conditions are required to exploit this vulnerability?

Exploitation requires an OpenVPN server using username-as-common-name with RADIUS or LDAP authentication and a malicious username containing a double quote.