CVE-2026-58390

Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.1.11

Description The OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view fail to apply quote-safe encoding to the common name of a client when placing it into data-common-name attributes. This allows an authenticated client with a backend username containing a double quote—specifically in environments using RADIUS or LDAP authentication with the username-as-common-name configuration—to inject an event handler. The script executes within an administrator's session when they access the dashboard or connection-status page and trigger the event. This can lead to the disclosure of config.xml, invocation of privileged APIs, resetting of the root password, and root command execution.

Recommendations Update to version 26.1.11.