CVE-2026-58392 opnsense CVE debrief

Who should care

Defenders responsible for OPNsense installations, particularly those with user accounts having page-services-ntp-gps privilege, should assess exposure and apply the patch. This includes reviewing system configurations, verifying user privileges, and ensuring that updates are applied in a timely manner. Additionally, security teams should monitor for potential suspicious activity and review logs for exposed assets.

Why it matters

A stored XSS vulnerability in OPNsense Services: NTP GPS allows authenticated users to store malicious values that can execute script in other users' sessions, potentially leading to unauthorized actions.

• Authenticated users with page-services-ntp-gps privilege can store malicious values.
• Script execution in the session of users viewing the GPS page.
• Reading of CSRF material and performance of authenticated actions.
• Potential for actions available to an administrator.

Technical summary

The OPNsense Services: NTP GPS page stores user-supplied initcmd values in base64 form, applies legacy_html_escape_form_data() to the encoded string, and then uses base64_decode() to decode the value directly into the GPS initialization-command textarea. Because decoding occurs after escaping, stored HTML remains unescaped at the output sink. A user with page-services-ntp-gps privilege can store a value that closes the textarea, and script executes in the session of any user who later opens the GPS page. The script can read CSRF material and perform authenticated actions, including actions available to an administrator. This issue is fixed in version 26.1.11.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability allows for authenticated actions.

Recommended defensive actions

• Verify exposure by checking if the installed version of OPNsense core is less than 26.1.11.
• Apply the patch by updating to version 26.1.11 or later.
• Monitor for suspicious activity on the NTP GPS page.
• Restrict access to the NTP GPS page to authorized users only.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is fixed in version 26.1.11 of OPNsense core. The affected version is < 26.1.11. This issue was identified in OPNsense Services: NTP GPS page, where user-supplied initcmd values are stored in base64 form, and then decoded without proper escaping, allowing for stored HTML to remain unescaped at the output sink. Defenders should verify exposure by checking the installed version and apply the patch by updating to version 26.1.11 or later. Evidence is based on official CVE Program records and source-specific details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.