OS-ACME-CLIENT · CVE-2026-123025 · Infrastructure
FIX → 4.18 ✓ verified
The os-acme-client plugin for OPNsense builds a shell command from Google Cloud account and project fields without escaping them. An authenticated user who can issue or renew certificates can inject commands and run code as root.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only OPNsense firewalls running the os-acme-client plugin through 4.17 with the Google Cloud DNS validation method configured are exposed. The attacker must already hold an account that can issue or renew certificates through the WebGUI or API. Teams not using os-acme-client with Google Cloud DNS can skip it.
Not affected if auth-required, no-os-acme-client, not-google-cloud-dns
Who cares firewall, google-cloud-dns, opnsense, os-acme-client
Upgrade to 4.18
fix command injection in Google Cloud DNS validation, reported by @cppghoul)An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare() method decodes the dns_gcloud_key model field and directly interpolates the string fields gcloud_account and gcloud_project into a shell command passed to proc_open() via LeUtils::run_shell_command() without any validation or escaping. A remote authenticated user with privileges to issue or renew certificates through the WebGUI/API can achieve arbitrary code execution as root.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.