CVE-2026-49131 Deciso B.V. CVE debrief

Who should care

Firewall administrators, security teams, and IT personnel responsible for OPNsense deployments should assess exposure and verify the presence of this issue in their environments. They should prioritize patching or mitigating this vulnerability to prevent potential session hijacking or credential theft.

Why it matters

This stored cross-site scripting vulnerability in OPNsense allows authenticated attackers to inject malicious scripts, potentially leading to session hijacking or credential theft. Defenders should prioritize patching or mitigating this vulnerability to prevent these consequences.

• Potential session hijacking or credential theft
• Execution of injected scripts in the browser of authenticated users
• Compromise of Firewall Rules page integrity
• Possible lateral movement within the network

Technical summary

The vulnerability exists in OPNsense before version 26.1.9, allowing authenticated attackers with firewall rule management privileges to inject arbitrary HTML or JavaScript by embedding payloads in the firewall rule description field via the filter API endpoint. The unsanitized description value is persisted and later rendered through the default cell formatter in opnsense_bootgrid.js, causing injected scripts to execute in the browser of any authenticated user who views the Firewall Rules page.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability to prevent potential session hijacking or credential theft. Firewall administrators and security teams responsible for OPNsense deployments should assess exposure and verify the presence of this issue in their environments.

Recommended defensive actions

• Patch OPNsense to version 26.1.9 or later
• Restrict firewall rule management privileges to trusted users
• Monitor Firewall Rules page views for suspicious activity
• Consider implementing additional security controls, such as input validation and output encoding
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description, CVSS score, and affected product information. Additional references include links to OPNsense release notes and a VulnCheck advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.