Stored Cross-Site Scripting Vulnerability in OPNsense by Deciso
CVE-2026-49132

5.1MEDIUM

Key Information:

Vendor

Deciso B.v.

Status
Opnsense
Vendor
CVE Published:
3 August 2026

What is CVE-2026-49132?

A stored cross-site scripting vulnerability exists in OPNsense versions prior to 26.1.9. This security issue allows authenticated attackers to inject malicious HTML or JavaScript code into the certificate description field via the trust certificate API. The compromised description value is stored without proper sanitization and is later rendered in the Dashboard Certificates widget. As the raw value is directly embedded into HTML content, it leads to the execution of injected scripts in the browsers of authenticated users. This flaw presents serious risks, including session hijacking and credential theft, undermining the security integrity of users accessing the Dashboard.

Affected Version(s)

OPNsense 0

References

https://docs.opnsense.org/releases/CE_26.1.html#june-02-2026
release-notes
https://github.com/opnsense/core/commit/12b021ff11db38705...
patch
https://www.vulncheck.com/advisories/opnsense-stored-xss-...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Williams from Pellera Technologies
VulnCheck
.