# CVE-2026-49131: OPNsense stored cross-site scripting in firewall rules

Source: https://junglewise.ai/threats/cve-2026-49131-opnsense-stored-cross-site-scripting-in-firewall-rules  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-49131 · Severity: medium · CVSS 5.4 · Published 2026-08-03

OPNsense is an open-source firewall used to protect networks and route traffic. A vulnerability before version 26.1.9 allows authenticated administrators with firewall rule management privileges to inject malicious scripts into firewall rule descriptions. When other administrators view the firewall rules page, these scripts execute in their browsers, enabling attackers to steal login credentials or hijack administrative sessions.

Technologies: [OPNsense](https://junglewise.ai/threats/technologies/opnsense). Vendors: [OPNsense](https://junglewise.ai/threats/vendors/opnsense).

## Quick answers

**Is CVE-2026-49131 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49131 being exploited in the wild.

**How severe is CVE-2026-49131?** Medium severity, with a CVSS score of 5.4, published 3 August 2026.

**Which products and versions are affected?** OPNsense before 26.1.9.

**Is there a fix for CVE-2026-49131?** A patch was published on 26.1.9: Fix applied via commit b11d6b3 adding html_safe() escaping to firewall rule description output Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49131 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-49131?** Check whether you run OPNsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in the firewall rule description field, where unsanitized user input is persisted to the database via the filter API endpoint. The vulnerable component is the default cell formatter in opnsense_bootgrid.js, which renders rule descriptions by directly assigning raw cell content to innerHTML without sanitization. An authenticated attacker with firewall rule management privileges can embed arbitrary HTML or JavaScript payloads in the description field. When any authenticated user accesses the Firewall Rules page, the injected scripts execute in their browser context with the same privileges. The vulnerability was fixed in version 26.1.9 by adding an HTML escape function to sanitize the description output before rendering.

## Affected products

- OPNsense OPNsense before 26.1.9

## Timeline

- 2026-08-03: disclosed
- 26.1.9: patched: Fix applied via commit b11d6b3 adding html_safe() escaping to firewall rule description output

## References

- [https://docs.opnsense.org/releases/CE_26.1.html](https://docs.opnsense.org/releases/CE_26.1.html)
- [https://github.com/opnsense/core/commit/b11d6b340716e240868ab19a369e058a46f0876f](https://github.com/opnsense/core/commit/b11d6b340716e240868ab19a369e058a46f0876f)

## Related threats

- [OPNsense configuration line injection via GUI and API fields](https://junglewise.ai/threats/cve-2026-57154-opnsense-is-a-freebsd-based-firewall-and-routing-platform-prior)
- [OPNsense cross-site scripting in web interface](https://junglewise.ai/threats/cve-2026-115425-multiple-cross-site-scripting-xss-vulnerabilities-affect)
- [OPNsense newline injection in WebGUI login lockout bypass](https://junglewise.ai/threats/cve-2026-63442-opnsense-is-a-freebsd-based-firewall-and-routing-platform-prior)
- [OPNsense stored cross-site scripting in firewall rule and NAT tooltips](https://junglewise.ai/threats/cve-2026-58391-opnsense-is-a-freebsd-based-firewall-and-routing-platform-prior)
- [OPNsense stored XSS in OpenVPN connection-status widget](https://junglewise.ai/threats/cve-2026-58390-opnsense-is-a-freebsd-based-firewall-and-routing-platform-prior)