Stored Cross-Site Scripting in pfSense Firewall Management Interface

CVE-2026-67189

What is CVE-2026-67189?

The pfSense firewall products are susceptible to a stored cross-site scripting vulnerability that could allow an attacker to inject arbitrary JavaScript into the administrator interface. This issue arises in the Traffic Graphs feature where PTR records from reverse DNS lookups are not properly sanitized before being rendered. If an attacker controls a malicious PTR record and generates enough traffic to be listed as a top talker, they can execute JavaScript in the browser of an authenticated administrator. This exploitation could lead to unauthorized access to the firewall management settings, enabling the creation of accounts and execution of arbitrary commands on the underlying operating system, posing significant security risks.

References