OPNsense os-acme-client: OS command injection via DNS validation (CVE-2026-123025)
An OS command injection vulnerability in the OPNsense os-acme-client plugin allows remote authenticated users to achieve root code execution by manipulating DNS validation parameters.
CVE search metadata
CVE search record: CVE-2026-123025. KEV: no. Product: os-acme-client (<= 4.17). Brief: OPNsense os-acme-client: OS command injection via DNS validation (CVE-2026-123025). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-123025/
Triage facts
Revision 1- Applicability
- os-acme-client (<= 4.17)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 5, 09:06 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B2Likely
CVE-2026-123025 is an OS command injection vulnerability within the Google Cloud DNS validation module of the OPNsense os-acme-client plugin, affecting versions 4.17 and earlier. The vulnerability exists in the DnsGcloud::prepare() method, where the gcloud_account and gcloud_project fields are interpolated into shell commands passed to proc_open() via LeUtils::run_shell_command() without sufficient sanitization. A remote authenticated user with access to the WebGUI or API for certificate management can inject arbitrary shell commands, resulting in code execution with root privileges.
Impact
Successful exploitation allows a remote authenticated attacker to execute arbitrary commands on the affected OPNsense device with root-level permissions.
Recommendation
- Inventory all OPNsense instances running the os-acme-client plugin to identify vulnerable versions (4.17 or earlier).
- Monitor WebGUI and API access logs for unusual activity involving certificate management endpoints, particularly those interacting with the Google Cloud DNS validation configuration.
- Apply the security update provided by the vendor via the official OPNsense repository immediately upon availability.
- Restrict access to the OPNsense WebGUI and API to trusted administrative sources to mitigate the risk of unauthorized exploitation.
Immediate actions
Patch OPNsense os-acme-client plugin to the latest version to resolve CVE-2026-123025.
Threat Hunt
Monitor for suspicious WebGUI or API requests targeting the ACME certificate configuration, specifically looking for anomalous values in Google Cloud DNS account/project fields.
Data: Web server access logs, API audit logs
Mitigations
Restrict WebGUI and API access to authorized administrative IP addresses.
CVE-2026-123025