CVE-2026-58390 opnsense CVE debrief

Who should care

Administrators of OPNsense systems, particularly those with OpenVPN servers configured with username-as-common-name and RADIUS or LDAP authentication, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-58390 is a stored XSS vulnerability in OPNsense that can lead to root RCE. It affects OpenVPN connection-status views and dashboard widgets. Administrators should verify their configurations and upgrade to version 26.1.11 or later.

• Potential for stored XSS and root RCE in administrator sessions
• Possible unauthorized access to config.xml and privileged APIs
• Required verification of OpenVPN client configurations and system upgrades

Technical summary

The OpenVPN connection-status dashboard widget and connection-status view in OPNsense prior to version 26.1.11 place a client common_name into data-common-name attributes without quote-safe encoding, allowing for stored XSS and potential root RCE. The vulnerability requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register a valid backend username containing a double quote. An authenticated client using that username can close the attribute and add an event handler, while the local user database is not affected because its username validator rejects quotes.

Defensive priority

Administrators of OPNsense systems should prioritize verification of their OpenVPN client configurations and upgrade to version 26.1.11 or later.

Recommended defensive actions

• Verify OpenVPN client configurations for potential vulnerabilities
• Upgrade to OPNsense version 26.1.11 or later
• Review and restrict OpenVPN server configurations to prevent exploitation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in OpenVPN connection-status dashboard widget and connection-status view in OPNsense prior to version 26.1.11. The vulnerability requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register a valid backend username containing a double quote. Deployments where the same administrator controls both the identity backend and firewall do not cross a separate The

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.