# CVE-2026-44194: OPNsense OS command injection in user management

Source: https://junglewise.ai/threats/cve-2026-44194-opnsense-os-command-injection-in-user-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-44194 · Severity: critical · CVSS 9.1 · Published 2026-05-13

OPNsense is a firewall and routing platform used to secure corporate and private networks. A security flaw allows an administrator with user-management permissions to execute malicious commands on the underlying operating system with the highest level of authority (root). This could lead to a complete takeover of the firewall, allowing an attacker to intercept network traffic, disable security protections, or gain a foothold in the internal network.

Technologies: [OPNsense](https://junglewise.ai/threats/technologies/opnsense). Vendors: [OPNsense](https://junglewise.ai/threats/vendors/opnsense).

## Quick answers

**Is CVE-2026-44194 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44194 being exploited in the wild.

**How severe is CVE-2026-44194?** Critical severity, with a CVSS score of 9.1, published 13 May 2026.

**Which products and versions are affected?** OPNsense < 26.1.8.

**Is there a fix for CVE-2026-44194?** A patch was published on 2026-05-13: Vulnerability fixed in version 26.1.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44194 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44194?** Check whether you run OPNsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability exists in OPNsense core within the local user synchronization script (core/src/opnsense/scripts/auth/sync_user.php). The root cause is the improper neutralization of the $username variable when passed to the mwexecf function, which executes shell commands. While the web interface and API validate usernames, they permit valid email addresses; an attacker can exploit this by wrapping shell metacharacters in quotes within the 'local-part' of an email address. This payload bypasses validation but is interpreted by the shell when the script invokes pluginctl. Successful exploitation requires high privileges (user-management) but results in arbitrary command execution as the root user. The issue is fixed in version 26.1.8 by properly parameterizing the shell command.

## Affected products

- OPNsense OPNsense core < 26.1.8

## Timeline

- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: CVE-2026-44194 published to NVD
- 2026-05-13: patched: Vulnerability fixed in version 26.1.8

## References

- [https://github.com/opnsense/core/security/advisories/GHSA-f59w-m967-9rf6](https://github.com/opnsense/core/security/advisories/GHSA-f59w-m967-9rf6)

## Related threats

- [OPNsense configuration line injection via GUI and API fields](https://junglewise.ai/threats/cve-2026-57154-opnsense-is-a-freebsd-based-firewall-and-routing-platform-prior)
- [OPNsense cross-site scripting in web interface](https://junglewise.ai/threats/cve-2026-115425-multiple-cross-site-scripting-xss-vulnerabilities-affect)
- [OPNsense newline injection in WebGUI login lockout bypass](https://junglewise.ai/threats/cve-2026-63442-opnsense-is-a-freebsd-based-firewall-and-routing-platform-prior)
- [OPNsense stored cross-site scripting in firewall rule and NAT tooltips](https://junglewise.ai/threats/cve-2026-58391-opnsense-is-a-freebsd-based-firewall-and-routing-platform-prior)
- [OPNsense stored XSS in OpenVPN connection-status widget](https://junglewise.ai/threats/cve-2026-58390-opnsense-is-a-freebsd-based-firewall-and-routing-platform-prior)