CVE-2026-58391

Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.1.11

Description Firewall Rules and NAT views fail to apply quote-safe encoding to stored category names and alias descriptions within the filter rule.volt and nat rule.volt files. Because the response layer utilizes ENT NOQUOTES, double quotes are not escaped, allowing an attacker to close the HTML title attribute and inject an event-handler attribute into the span element. A user with Firewall Categories or Firewall Alias Edit privileges can trigger this by storing a malicious category name or alias description and assigning it to a filter or NAT rule. When an administrator or another user views the affected Rules or NAT page, the injected script executes in their session, potentially allowing the attacker to access Cross-Site Request Forgery (CSRF) material—a technique used to trick a user into executing unwanted actions—and perform authenticated actions as the victim.

Recommendations Update to version 26.1.11.