HTML Injection Vulnerability in OPNsense Firewall by Deciso
CVE-2026-58394

5.2MEDIUM

Key Information:

Vendor

Opnsense

Status
Core
Vendor
CVE Published:
15 October 2026

What is CVE-2026-58394?

A vulnerability in OPNsense, a FreeBSD-based firewall and routing platform, enables HTML injection through the SSL Certificate selector. Prior to version 26.1.11, the system improperly handled certificate description rendering by not escaping HTML metacharacters. This vulnerability allows users with specific privileges to inject and execute markup when another user accesses the System Settings Administration page, potentially compromising the security of the interface.

Affected Version(s)

core < 26.1.11

References

https://github.com/opnsense/core/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/opnsense/core/commit/9d0a590e9c49f4374...
x_refsource_MISC
https://github.com/opnsense/core/commit/adcb02f8f68071e63...
x_refsource_MISC

CVSS V3.1

Score:
5.2
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.