CVE-2026-49132 Deciso B.V. CVE debrief

Who should care

System administrators and security teams responsible for OPNsense installations should assess exposure and prioritize remediation to prevent session hijacking and credential theft.

Why it matters

CVE-2026-49132 is a stored cross-site scripting vulnerability in OPNsense before 26.1.9, allowing authenticated attackers to inject arbitrary HTML or JavaScript via the certificate description field. System administrators and security teams should assess exposure and prioritize remediation to prevent session hijacking and credential theft.

• Authenticated attackers can inject HTML or JavaScript, enabling session hijacking
• Credential theft is possible through injected scripts in the Dashboard
• Remediation priority is high for OPNsense installations
• Verification of OPNsense version and exposure is necessary

Technical summary

A stored cross-site scripting vulnerability exists in OPNsense before 26.1.9, allowing authenticated attackers to inject arbitrary HTML or JavaScript via the certificate description field. The unsanitized description value is persisted and later rendered in the Dashboard Certificates widget, enabling injected scripts to execute in the browser of any authenticated user who views the Dashboard. This can lead to session hijacking or credential theft. The vulnerability is due to the lack of proper encoding of the description value when rendering it in the Dashboard.

Defensive priority

Authenticated attackers can inject HTML or JavaScript via the certificate description field, enabling session hijacking or credential theft in the Dashboard.

Recommended defensive actions

• Review and update OPNsense installations to version 26.1.9 or later
• Restrict access to the trust certificate API
• Monitor Dashboard Certificates widget for suspicious activity
• Implement additional security measures to prevent session hijacking and credential theft
• Conduct a thorough review of OPNsense configurations and certificate descriptions
• Verify the integrity of Dashboard Certificates widget rendering
• Track and document remediation progress and verification efforts

Evidence notes

The CVE description details a stored cross-site scripting vulnerability in OPNsense before 26.1.9, allowing authenticated attackers to inject arbitrary HTML or JavaScript via the certificate description field.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.