OpenVPN Client Dashboard Vulnerability in OPNsense Firewall

CVE-2026-58390

What is CVE-2026-58390?

A critical vulnerability has been identified in the OpenVPN connection-status dashboard widget of OPNsense, allowing an attacker to exploit improperly encoded data attributes. This vulnerability arises when a backend username with double quotes is provisioned, leading to potential code injection in an authenticated session. When an administrator views the dashboard, the injected script can execute operations such as reading configuration files or resetting credentials. This issue is particularly concerning in environments where the identity backend and the firewall are managed by the same administrator, as it undermines security boundaries. Users are strongly urged to upgrade to version 26.1.11 or higher to mitigate this risk.

References