CVE-2026-123025
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare() method decodes the dns_gcloud_key model field and directly interpolates the string fields gcloud_account and gcloud_project into a shell command passed to proc_open() via LeUtils::run_shell_command() without any validation or escaping. A remote authenticated user with privileges to issue or renew certificates through the WebGUI/API can achieve arbitrary code execution as root.
| CWE | CWE-78 |
| Vendor | opnsense |
| Product | os-acme-client |
| Published | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for opnsense os-acme-client
Be the first to know when new unknown vulnerabilities affecting opnsense os-acme-client are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
OPNsense / os-acme-client
0 ≤ 4.17.0