OS Command Injection Vulnerability in OPNsense Google Cloud DNS Validation Plugin
CVE-2026-123025

9.4CRITICAL

Key Information:

Vendor

Opnsense

Status
Os-acme-client
Vendor
CVE Published:
5 November 2026

What is CVE-2026-123025?

An OS Command Injection vulnerability has been identified in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin up to version 4.17. This vulnerability allows a remote authenticated user with the ability to manage certificates via the WebGUI or API to potentially execute arbitrary code as root. This occurs due to the DnsGcloud::prepare() method, which decodes the dns_gcloud_key model field and improperly interpolates the gcloud_account and gcloud_project string fields into a shell command without sufficient validation or escaping, raising concerns over the security of dependent systems.

Affected Version(s)

os-acme-client FreeBSD 0 <= 4.17.0

References

https://github.com/opnsense/plugins/pull/5873

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.