CVE-2026-49132: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Deciso B.V. OPNsense
OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized description value is persisted and later rendered in the Dashboard Certificates widget through Certificates.js, which interpolates the raw value into HTML attribute and text content sinks without encoding, causing injected scripts to execute in the browser of any authenticated user who views the Dashboard, enabling session hijacking or credential theft.
AI Analysis
Technical Summary
CVE-2026-49132 is a stored cross-site scripting vulnerability affecting OPNsense before version 26.1.9. The flaw arises because the certificate description field accepts input that is not properly sanitized. Attackers with authentication privileges can embed malicious HTML or JavaScript payloads via the trust certificate API. These payloads are stored and subsequently rendered in the Dashboard Certificates widget through Certificates.js without proper encoding, causing the injected scripts to execute in the context of authenticated users' browsers.
Potential Impact
Successful exploitation allows an authenticated attacker to execute arbitrary scripts in the browsers of other authenticated users who view the Dashboard. This can lead to session hijacking or theft of credentials, compromising user accounts and potentially the security of the OPNsense management interface.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the trust certificate API to trusted users only and avoid viewing the Dashboard Certificates widget with untrusted certificates. Monitor vendor communications for updates on patches or official mitigations.
CVE-2026-49132: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Deciso B.V. OPNsense
Description
OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized description value is persisted and later rendered in the Dashboard Certificates widget through Certificates.js, which interpolates the raw value into HTML attribute and text content sinks without encoding, causing injected scripts to execute in the browser of any authenticated user who views the Dashboard, enabling session hijacking or credential theft.
CVSS v4.0
Score 5.1medium
Affected software
Deciso B.V.
OPNsense
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-49132 is a stored cross-site scripting vulnerability affecting OPNsense before version 26.1.9. The flaw arises because the certificate description field accepts input that is not properly sanitized. Attackers with authentication privileges can embed malicious HTML or JavaScript payloads via the trust certificate API. These payloads are stored and subsequently rendered in the Dashboard Certificates widget through Certificates.js without proper encoding, causing the injected scripts to execute in the context of authenticated users' browsers.
Potential Impact
Successful exploitation allows an authenticated attacker to execute arbitrary scripts in the browsers of other authenticated users who view the Dashboard. This can lead to session hijacking or theft of credentials, compromising user accounts and potentially the security of the OPNsense management interface.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the trust certificate API to trusted users only and avoid viewing the Dashboard Certificates widget with untrusted certificates. Monitor vendor communications for updates on patches or official mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-05-27T17:40:12.738Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a70fecabf32cb7a342e207f
Added to database: 08/03/2026, 20:49:14 UTC
Last enriched: 08/11/2026, 18:16:56 UTC
Last updated: 09/17/2026, 22:01:36 UTC
Views: 51
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.