# CVE-2026-49132: OPNsense stored cross-site scripting in certificate description

Source: https://junglewise.ai/threats/cve-2026-49132-opnsense-stored-cross-site-scripting-in-certificate-description  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-49132 · Severity: medium · CVSS 5.4 · Published 2026-08-03

OPNsense is an open-source firewall management system used to protect and control network traffic. Before version 26.1.9, authenticated users could inject malicious code into certificate descriptions via the API. When other administrators view the Dashboard's Certificates widget, this injected code executes in their browsers, potentially allowing attackers to steal session credentials or hijack administrative accounts.

Technologies: [OPNsense](https://junglewise.ai/threats/technologies/opnsense). Vendors: [OPNsense](https://junglewise.ai/threats/vendors/opnsense).

## Quick answers

**Is CVE-2026-49132 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49132 being exploited in the wild.

**How severe is CVE-2026-49132?** Medium severity, with a CVSS score of 5.4, published 3 August 2026.

**Which products and versions are affected?** OPNsense before 26.1.9.

**Is there a fix for CVE-2026-49132?** A patch was published on 2026-01-29: Fixed in version 26.1.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49132 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-49132?** Check whether you run OPNsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in OPNsense's certificate management API. An authenticated attacker can inject arbitrary JavaScript into the certificate description field via the trust certificate API endpoint. The unsanitized description value is persisted in the database and later rendered in the Dashboard Certificates widget (Certificates.js) without proper HTML encoding, causing the injected scripts to execute in the browser context of any authenticated user who accesses the Dashboard. The attack requires prior authentication but no additional user interaction. The fix was applied in version 26.1.9 by removing the unescaped data-tooltip attribute that rendered the description field.

## Affected products

- OPNsense OPNsense before 26.1.9

## Timeline

- 2026-08-03: disclosed
- 2026-01-29: patched: Fixed in version 26.1.9

## References

- [https://docs.opnsense.org/releases/CE_26.1.html](https://docs.opnsense.org/releases/CE_26.1.html)
- [https://github.com/opnsense/core/commit/12b021ff11db38705e92ac4c9af5e07d602da6ba](https://github.com/opnsense/core/commit/12b021ff11db38705e92ac4c9af5e07d602da6ba)

## Related threats

- [OPNsense configuration line injection via GUI and API fields](https://junglewise.ai/threats/cve-2026-57154-opnsense-is-a-freebsd-based-firewall-and-routing-platform-prior)
- [OPNsense cross-site scripting in web interface](https://junglewise.ai/threats/cve-2026-115425-multiple-cross-site-scripting-xss-vulnerabilities-affect)
- [OPNsense newline injection in WebGUI login lockout bypass](https://junglewise.ai/threats/cve-2026-63442-opnsense-is-a-freebsd-based-firewall-and-routing-platform-prior)
- [OPNsense stored cross-site scripting in firewall rule and NAT tooltips](https://junglewise.ai/threats/cve-2026-58391-opnsense-is-a-freebsd-based-firewall-and-routing-platform-prior)
- [OPNsense stored XSS in OpenVPN connection-status widget](https://junglewise.ai/threats/cve-2026-58390-opnsense-is-a-freebsd-based-firewall-and-routing-platform-prior)