OPNsense CVE-2026-58391

Exploitation requires an authenticated account holding the Firewall Categories or Firewall Alias Edit privilege to store a malicious category name or alias description. The poisoned category must then be assigned to a filter or NAT rule, OR the alias must be referenced as a rule source or destination, and that rule must be saved so the affected tooltip (data-toggle="tooltip" title attribute) is rendered. Execution is gated on a second user - an administrator or other user - actually opening the affected Firewall Rules or NAT page (UI:R). Limiting factors: the attacker needs pre-existing firewall-editing privileges (not a default/anonymous capability), a victim must view the specific page, and only versions prior to 26.1.11 are affected; the flaw does not exist against default low-trust deployments where untrusted users lack category/alias edit rights.

This is a moderate-risk, authenticated stored XSS (CWE-79) in OPNsense core prior to 26.1.11, and the supplied signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N = 5.4) correctly captures a low-privilege attacker (PR:L - a user with Firewall Categories or Firewall Alias Edit rights) who injects a payload that later fires in a different, typically higher-privileged user's session (S:C scope change, UI:R because a victim must open the affected page). No EPSS score, CISA KEV entry, or public POC is present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - this is not a drive-by, internet-facing bug. The practical risk is bounded by two real gates: the attacker must already hold a privileged firewall-editing role, and an administrator must subsequently view the poisoned Rules or NAT page. That makes this primarily a privilege-escalation / insider or post-compromise lateral-movement issue rather than a mass-exploitation priority; its value is that successful execution yields CSRF material and authenticated actions as an administrator on a security device. The hackerask.com reference may contain technical write-up detail but is not confirmed as working exploit code. Treat as a 'patch-in-normal-cycle, prioritize if low-trust accounts can edit firewall categories/aliases' issue, not an emergency.

A semi-trusted operator with only Firewall Categories or Firewall Alias Edit privileges stores a category name or alias description containing a double quote that breaks out of the HTML title attribute and injects an event-handler attribute; they assign the category to a rule (or have the alias referenced by a rule) and save it. When an administrator later opens the Firewall Rules or NAT page, the tooltip renders and the script executes in the admin's session, stealing CSRF tokens and performing authenticated actions as the administrator. No public exploit code is identified at time of analysis, but the root cause is confirmed by the vendor fix commits (ENT_NOQUOTES encoding left double quotes unescaped in filter_rule.volt / nat_rule.volt).