CVE-2026-123025: Critical Command Injection in OPNsense ACME plugin

CVE-2026-123025 is an OS Command Injection vulnerability in the Google Cloud DNS validation module of OPNsense's os-acme-client plugin, version 4.17 and earlier. The flaw allows a remote authenticated user with privileges to issue or renew certificates via WebGUI or API to execute arbitrary commands as root. The defect lies in the DnsGcloud::prepare() method, which directly interpolates gcloud_account and gcloud_project fields into a shell command without validation or escaping, exposing systems running this Let's Encrypt configuration with Google Cloud provider.

The CVSS score is 9.4, rated as critical. The vulnerability was published on NVD on November 5, 2026. A public signal from November 6, 2026 comes from a GitHub repository declaring it contains exploit code for this vulnerability. This indicates a critical exposure window for unpatched systems. The required authentication limits exploitation to users with WebGUI/API access, but does not reduce the severity of impact: code execution as root grants complete control of OPNsense systems.

Priority defensive actions: 1) Verify whether os-acme-client plugin is installed and active on OPNsense servers in use. 2) Check version and apply patch when available. 3) In the short term, restrict WebGUI/API access and revoke certificate issuance privileges from non-essential administrative accounts. 4) Monitor system logs for suspicious command execution activity. 5) Contact the vendor for patch status and release timeline.