OPNsense os-acme-client Command Injection (CVE-2026-123025)

CVE-2026-123025 is an OS command injection in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin. The CVE record says the DnsGcloud::prepare() method decodes the dns_gcloud_key model field. It then places the string fields gcloud_account and gcloud_project straight into a shell command that proc_open() runs through LeUtils::run_shell_command().

The record says that no validation or escaping happens on the way. A remote authenticated user who may issue or renew certificates through the WebGUI or API can reach arbitrary code execution as root. The weakness is filed as CWE-78.

How the Fix in 4.18 Works

The OPNsense plugins repository fixed the flaw in pull request 5873, merged on 3 November 2026 as plugin release 4.18. The plugin changelog lists it as a command injection in Google Cloud DNS validation, reported by a researcher using the handle cppghoul.

The diff changes five gcloud commands in DnsGcloud.php. Each value now goes through Shell::exec_safe as a %s argument instead of being pasted into the command string. The CVE record names only the account and project fields, but the change also covers the configuration name and key file arguments.

Who Can Exploit It

The CVSS 4.0 vector sets privileges required to Low and user interaction to None. The attacker therefore needs an account, but no victim has to click anything. Attack vector is Network, because the WebGUI and the API are the entry points.

The record does not say whether the right to issue or renew certificates is separate from full administration. We recommend treating every account that holds it as able to reach root on the firewall until the plugin is updated. Our least privilege entry explains why such rights should stay narrow.

What NVD and CISA KEV Say

NVD published the entry on 5 November 2026 and lists it as Received, so NVD has not analysed it yet. The CVE record came out the same day, with MITRE as the CNA. CISA's KEV catalog, version 2026.11.04, does not list the CVE.

Our remote code execution glossary entry explains what root-level command execution gives an attacker. Our Dameware post on authenticated command injection shows the same bug class in another product.

The CVE record lists the os-acme-client plugin for OPNsense on FreeBSD, in versions up to and including 4.17.0. NVD copies the same range from the CNA. The record names no fixed version, so 4.18 comes from the pull request and the plugin changelog.

The 4.18 changelog also carries a breaking change. The Selfhost DNS API now needs an API key, and credentials must be entered again. Anyone who validates certificates through that method should plan the re-entry during the update.

The record does not say whether the Google Cloud DNS method has to be configured for a firewall to be exposed. We recommend updating either way, because the record lists every version through 4.17. Our vulnerability management guide covers how to track a plugin rollout across many firewalls.