# CVE-2026-123025: OPNsense os-acme-client command injection in Google Cloud DNS

Source: https://junglewise.ai/threats/cve-2026-123025-an-os-command-injection-vulnerability-was-discovered-in-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-123025 · Severity: info · Published 2026-11-05

OPNsense's ACME client plugin is used to manage SSL/TLS certificates with Google Cloud DNS validation. An authenticated administrator can inject arbitrary OS commands through improperly validated DNS configuration fields, allowing them to execute code with root privileges on the firewall.

Vendors: [OPNsense](https://junglewise.ai/threats/vendors/opnsense).

## Quick answers

**Is CVE-2026-123025 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123025 being exploited in the wild.

**How severe is CVE-2026-123025?** Informational severity, published 5 November 2026.

**Which products and versions are affected?** OPNsense Os-Acme-Client through 4.17.

**Is there a fix for CVE-2026-123025?** Yes: fixed in os-acme-client 4.18. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123025 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-123025?** Check whether you run OPNsense Os-Acme-Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in os-acme-client 4.18

## Technical details

An OS command injection vulnerability exists in the DnsGcloud::prepare() method, where user-controlled gcloud_account and gcloud_project fields are interpolated directly into a shell command passed to proc_open() without validation or escaping. A remote authenticated user with certificate management privileges can exploit this by crafting malicious configuration values to achieve arbitrary code execution as root.

## Affected products

- OPNsense os-acme-client through 4.17

## Timeline

- 2026-11-05: disclosed
- 2026-11-03: patched: Fix merged in PR #5873

## References

- [https://github.com/opnsense/plugins/pull/5873](https://github.com/opnsense/plugins/pull/5873)