CVE-2026-58393 opnsense CVE debrief

Who should care

OPNsense administrators and users with Client Specific Override privileges should assess exposure and verify their systems to ensure they are running a version that is not vulnerable to this issue. This includes reviewing system configurations, monitoring for suspicious activity, and updating to the latest version if necessary.

Why it matters

Authenticated users with Client Specific Override privileges can store path traversal values, potentially leading to generated CSO files being written outside the intended directory. This issue is fixed in OPNsense version 26.1.11.

• Verify OPNsense version and update to 26.1.11 or later
• Restrict Client Specific Override privileges for authenticated users
• Monitor for suspicious OpenVPN client-connect or authentication events

Technical summary

The OpenVPN Client Specific Override common_name field in OPNsense accepts path traversal sequences, allowing an authenticated user to store a traversal value. When a matching OpenVPN client-connect or authentication event occurs, a generated CSO file may be written outside the intended directory. The file content is generated OpenVPN configuration rather than arbitrary bytes. This issue is fixed in OPNsense version 26.1.11, and administrators should verify and update their systems accordingly to prevent potential exploitation.

Defensive priority

Medium priority for OPNsense administrators to verify and update their systems.

Recommended defensive actions

• Verify OPNsense version and update to 26.1.11 or later if necessary
• Review and restrict Client Specific Override privileges for authenticated users
• Monitor for suspicious activity related to OpenVPN client-connect or authentication events
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and fixed version. The issue is fixed in OPNsense version 26.1.11. There are no explicit details on the number of affected users or systems, but OPNsense administrators and users with Client Specific Override privileges should assess exposure and verify their systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.