CVE-2026-58391 opnsense CVE debrief

Who should care

Defenders responsible for OPNsense installations, particularly those with user privileges for Firewall Categories and Aliases, should assess exposure and prioritize updates. They should also review compensating controls for exposed systems and monitor for suspicious activity on Firewall Rules and NAT pages.

Why it matters

Defenders should care about this vulnerability as it allows for code execution in user sessions, potentially leading to authenticated actions as the victim and access to sensitive information. Prioritization of updates and review of user privileges are necessary.

• Code execution in user sessions
• Potential for authenticated actions as the victim
• Access to CSRF material and sensitive information

Technical summary

The vulnerability exists due to the lack of quote-safe encoding in HTML title attributes in filter_rule.volt and nat_rule.volt. An attacker can inject malicious code, which is executed in the session of an administrator or other user viewing the affected pages. The vulnerability allows for code execution in user sessions, potentially leading to authenticated actions as the victim and access to sensitive information. The fix is included in version 26.1.11 of OPNsense, which should be applied as soon as possible. Defenders should review user privileges for Firewall Categories and Aliases to prevent exploitation.

Defensive priority

Defenders should prioritize updating to version 26.1.11 or later and review user privileges for Firewall Categories and Aliases.

Recommended defensive actions

• Update OPNsense to version 26.1.11 or later
• Review and limit user privileges for Firewall Categories and Aliases
• Monitor for suspicious activity on Firewall Rules and NAT pages
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in versions prior to 26.1.11 and the fix in version 26.1.11. The vulnerability is caused by the lack of quote-safe encoding in HTML title attributes in filter_rule.volt and nat_rule.volt. An attacker can inject malicious code, which is executed in the session of an administrator or other user viewing the affected pages.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.