---
id: "CVE-2026-123025"
kind: "vulnerability"
aliases: ["CVE-2026-123025"]
title: "OPNsense: Google Cloud DNS plugin lets a certificate user run root commands"
severity: "critical"
cvss: 9.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "os-acme-client", "fixed": ["4.18"], "affected": "<= 4.17", "ecosystem": "vendor"}]
ecosystems: []
tags: ["firewall", "google-cloud-dns", "infrastructure", "opnsense", "os-acme-client"]
not_affected_if: ["auth-required", "no-os-acme-client", "not-google-cloud-dns"]
published_at: "2026-11-05T07:17:25+00:00"
first_seen_at: "2026-11-05T07:37:46+00:00"
updated_at: "2026-11-05T07:41:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123025", "first_seen_at": "2026-11-05T07:37:46+00:00"}, {"source": "analyst", "url": "https://raw.githubusercontent.com/opnsense/plugins/876f3396c783112f108dfedc98d5a743e0edeb52/security/acme-client/pkg-descr", "first_seen_at": "2026-11-05T07:41:43+00:00", "cites": ["https://raw.githubusercontent.com/opnsense/plugins/876f3396c783112f108dfedc98d5a743e0edeb52/security/acme-client/pkg-descr", "https://github.com/opnsense/plugins/commit/9929c65"]}]
exploit_sources: []
---

# OPNsense: Google Cloud DNS plugin lets a certificate user run root commands

The os-acme-client plugin for OPNsense builds a shell command from Google Cloud account and project fields without escaping them. An authenticated user who can issue or renew certificates can inject commands and run code as root.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:os-acme-client affected <= 4.17 fixed 4.18

## How to check

- Check the installed os-acme-client version (System > Firmware > Plugins/Status); versions through 4.17 are affected, 4.18 carries the fix.
- Check whether any ACME account/validation uses Google Cloud DNS (dns_gcloud); if none does, the vulnerable code path is not used.
- Review who holds ACME client / certificate issue-renew privileges in WebGUI/API.

## Fix

Update os-acme-client to 4.18 (changelog: 'fix command injection in Google Cloud DNS validation', reported by @cppghoul). Update via System > Firmware > Plugins / Updates; if 4.18 is not yet offered, the fix is in opnsense/plugins commit 9929c65 (Nov 3, 2026).

## Timeline

- 2026-11-05T07:37:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123025
- 2026-11-05T07:41:43+00:00 analyst https://raw.githubusercontent.com/opnsense/plugins/876f3396c783112f108dfedc98d5a743e0edeb52/security/acme-client/pkg-descr — Fix in opnsense/plugins commit 9929c65 (Nov 3 2026, fraenki, reported by @cppghoul); 4.18 changelog in commit 876f339 lists it. Did not confirm 4.18 is published to the package repo (master pkg-descr fetched was stale) or read the code diff; fix is from the changelog. No exploitation or PoC found; social posts not searched.

## Documents

- [fix] os-acme-client changelog, 4.18 (opnsense/plugins 876f339) https://raw.githubusercontent.com/opnsense/plugins/876f3396c783112f108dfedc98d5a743e0edeb52/security/acme-client/pkg-descr
- [fix] security/acme-client: fix command injection in Google Cloud DNS validation https://github.com/opnsense/plugins/commit/9929c65

## From the sources

An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare() method decodes the dns_gcloud_key model field and directly interpolates the string fields gcloud_account and gcloud_project into a shell command passed to proc_open() via LeUtils::run_shell_command() without any validation or escaping. A remote authenticated user with privileges to issue or renew certificates through the WebGUI/API can achieve arbitrary code execution as root.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_