Vulnerabilities

Vulnerability · GHSA-7wvp-6m2q-953c

CA/Cert PEM Imported Payload Allows OpenVPN Directive Injection Leading to Root OS Command Execution

Published Oct 29, 2026 · catalog updated Oct 29, 2026 · CA/Cert PEM Imported Payload

Last checked Nov 2, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for GHSA-7wvp-6m2q-953c. A missing EPSS score is not a low risk. Compare CA/Cert PEM Imported Payload with the linked advisory before you change production.

Severity

Medium6.4

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Not established

Affected products

See sources for product scope

### Summary A user with the delegated CA Manager role can import a certificate whose payload contains injected OpenVPN directives. OPNsense validates that the payload parses as a certificate but stores the raw attacker-supplied bytes verbatim. When an OpenVPN server instance references that CA, the injected directives are written into the root-run instance config and executed as root on instance startup, with no VPN clients required. ### Details #### Component - OPNsense - versions 25.7 and 26.7 tested directly - **CA/Cert import API** - , - **OpenVPN config writer** - in , emits inline CA blocks - **Trust store** - and #### Who An authenticated user holding the privilege, which is a delegated sub-admin role that can be granted independently of full administrator access. #### Cause calls to validate the import, then stores , which is the raw user-supplied text, not a re-serialized certificate. then reads only the first PEM block and silently ignores everything after , so arbitrary lines appended to a valid certificate pass validation unmodified. strips only carriage returns and blank lines. emits inline blocks as: with no further escaping, placing attacker-controlled lines directly into a config that already sets . ### Proof of concept A self-contained script ( in Appendix B) automates all steps below. **Step 1 - Generate two self-signed certificates.** One becomes the malicious CA payload; the other is a signing CA used only to issue the server cert OPNsense requires for the OpenVPN instance. **Step 2 - Build the malicious CA payload.** Append the injection after the PEM footer of : breaks out of the inline block wraps the CA in; becomes a top-level OpenVPN directive; the re-opened ensures the auto-appended balances. **Step 3 - Authenticate and obtain a CSRF token.** Extract the hidden input: , then: Extract the new CSRF token from the post-login page. Use it as for all subsequent API calls. **Step 4 - Import the malicious CA.** Response: - the injected lines are n

No affected version ranges are stored yet. Use the vendor advisory before you decide this record does not apply.