CVE-2026-58390: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in opnsense core

OPNsense core versions before 26.1.11 contain a CWE-79 improper neutralization of input vulnerability in the OpenVPN connection-status dashboard widget and connection-status view. The vulnerability arises because the client common_name is embedded into data-common-name HTML attributes without quote-safe encoding, enabling an authenticated attacker with a specially crafted username containing a double quote to inject malicious script. This requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, and the ability to provision or self-register such usernames. The injected script executes in the administrator's browser session when viewing the dashboard or connection-status page, allowing actions such as reading config.xml, invoking privileged APIs, resetting the root password, and executing commands as root. The vulnerability is addressed in OPNsense core version 26.1.11.

An authenticated attacker can exploit this vulnerability to execute arbitrary script code in an administrator's session, leading to full compromise of the firewall system. This includes reading sensitive configuration files, invoking privileged APIs, resetting the root password, and obtaining root-level command execution. The vulnerability crosses trust boundaries when the attacker can provision usernames with double quotes in an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication.

This vulnerability is fixed in OPNsense core version 26.1.11. Users should upgrade to version 26.1.11 or later to remediate this issue. There is no indication that any temporary or alternative mitigations are available. Patch status is confirmed fixed in 26.1.11.