Is CVE-2026-58390 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58390 being exploited in the wild.

How severe is CVE-2026-58390?

High severity, with a CVSS score of 8, published 15 October 2026.

Is there a fix for CVE-2026-58390?

Yes: fixed in 26.1.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-58390 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-58390?

Check whether you run OPNsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58390: OPNsense stored XSS in OpenVPN connection-status widget

CVE-2026-58390 · Severity: high · CVSS 8 · Published 2026-10-15

OPNsense is a firewall and routing platform that supports OpenVPN client connections. Prior to version 26.1.11, the dashboard widget displaying OpenVPN connection status fails to safely encode client usernames when rendering them in HTML, allowing authenticated attackers with specially crafted usernames (containing quotes) to inject malicious scripts. An attacker with a valid username can execute JavaScript in an administrator's session when the administrator views the dashboard, leading to root password reset and full system compromise.

Technologies: OPNsense. Vendors: OPNsense.

Quick answers

Is CVE-2026-58390 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58390 being exploited in the wild.
How severe is CVE-2026-58390?: High severity, with a CVSS score of 8, published 15 October 2026.
Which products and versions are affected?: OPNsense before 26.1.11.
Is there a fix for CVE-2026-58390?: Yes: fixed in 26.1.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58390 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-58390?: Check whether you run OPNsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 26.1.11

Technical details

A stored cross-site scripting (XSS) vulnerability exists in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view where the client common_name is placed into HTML data attributes without quote-safe encoding. When OpenVPN is configured with username-as-common-name and RADIUS/LDAP authentication, an attacker can provision or register a username containing double quotes to break out of the attribute and inject event handlers. The injected script executes with administrator privileges when the admin opens the dashboard or connection-status page.

Affected products

OPNsense OPNsense before 26.1.11

Timeline

2026-10-15: disclosed
2026-10-15: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.