CVE-2026-123025

Name of the Vulnerable Software and Affected Versions OPNsense os-acme-client versions prior to 4.18

Description An OS command injection issue exists in the Google Cloud DNS validation module. The DnsGcloud::prepare() method decodes the dns gcloud key model field and interpolates the gcloud account and gcloud project string fields into a shell command. This command is passed to proc open() via LeUtils::run shell command() without validation or escaping. A remote authenticated user with privileges to issue or renew certificates through the WebGUI or API can execute arbitrary code as root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.