Critical OPNsense Vulnerability Could Allow Attackers to Execute Commands as Root (CVE-2026-123025)

A critical security vulnerability affecting the OPNsense firewall platform could allow authenticated attackers to execute arbitrary operating system commands with root privileges.

The vulnerability, tracked as CVE-2026-123025, affects the os-acme-client plugin, specifically its Google Cloud DNS validation module. It has been assigned a critical CVSS 4.0 score of 9.4 out of 10, highlighting the potential severity of the issue.

The flaw is caused by an OS command injection weakness in the plugin’s handling of Google Cloud DNS configuration data. Specifically, the DnsGcloud::prepare() method processes account and project information without properly validating or escaping the supplied values before incorporating them into a shell command.

This creates an opportunity for an attacker to manipulate the command execution process and potentially run unauthorised commands on the underlying firewall operating system.

The issue is particularly concerning because successful exploitation could give an attacker complete control over the firewall. This could potentially allow them to access sensitive information, modify system configurations, disrupt network services or use the compromised device as a foothold for further attacks.

Affected versions

The vulnerability affects:

• OPNsense os-acme-client plugin versions up to and including 4.17.
• The Google Cloud DNS validation functionality is specifically affected.

The vulnerability is classified as CWE-78 (Improper Neutralisation of Special Elements used in an OS Command).

Fix released in version 4.18

A fix has been developed by the OPNsense development team. A GitHub pull request, merged on 3 November 2026, introduced version 4.18 of the ACME client plugin and specifically addressed the Google Cloud DNS command injection vulnerability.

The fix was contributed following a report from security researcher cppghoul. The developer confirmed that the changes included a command injection fix and a plugin version update. GitHub+1

Administrators should ensure that they update the os-acme-client plugin to version 4.18 or later once available through their OPNsense update channel.

Organisations that do not require the ACME client plugin should consider disabling or removing it. Administrators should also restrict access to the OPNsense WebGUI and API to trusted management networks.

Security implications

Firewalls are a critical component of network security, making vulnerabilities that allow privileged command execution particularly serious.

Although CVE-2026-123025 requires an authenticated user with sufficient privileges to manage certificate issuance or renewal, the possibility of obtaining root-level command execution means that a compromised account could potentially lead to a complete firewall compromise.

Organisations using OPNsense with Google Cloud DNS-based certificate validation should review their plugin versions and prioritise applying the available security fix.

Vulnerability details: CVE-2026-123025 – CVE Details

Developer fix: OPNsense GitHub security fix – Pull Request #5873