-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= pfSense-SA-26_20.webgui Security Advisory pfSense Topic: Potential authenticated arbitrary command execution via Kea custom JSON configuration Category: pfSense Base System Module: webgui Announced: 2026-08-13 Credits: @lujiefsi Affects: pfSense Plus software versions < 26.07 pfSense CE software versions <= 2.8.1 Corrected: 2026-07-21 16:01:22 UTC (pfSense Plus master, 26.10) 2026-07-21 16:03:39 UTC (pfSense Plus plus-RELENG_26_07, 26.07) 2026-07-21 16:01:22 UTC (pfSense CE master, 2.9.0) 0. Revision History v1.0 2026-08-13 Initial SA draft I. Background pfSense® software is a free network firewall distribution based on the FreeBSD operating system. The pfSense software distribution includes third- party free software packages for additional functionality, and provides most of the functionality of common commercial firewalls. pfSense® Plus is the productized version of pfSense software from Netgate®, previously referred to as pfSense Factory Edition (FE). It is available to Netgate appliance and CSP customers. The majority of users of pfSense software have never installed or used a stock FreeBSD system. Unlike similar GNU/Linux-based firewall distributions, there is no need for any UNIX knowledge. The command line is never used, and there is no need to ever manually edit any rule sets. Instead, pfSense software includes a web interface for the configuration of all included components. Users familiar with commercial firewalls will quickly understand the web interface, while those unfamiliar with commercial-grade firewalls may encounter a short learning curve. II. Problem Description There is a potential for authenticated command execution via Kea custom JSON configuration. When using the Kea DHCP server backend, the GUI presents option fields to submit custom JSON configuration snippets which will be placed directly into the Kea configuration. Some directives in the Kea configuration can allow users to execute arbitrary external commands. While allowing custom JSON configuration is intended functionality, the access privileges for the Kea configuration pages are not marked as granting full administrative access, and there is no separate access privilege for the custom configuration fields. This problem is present on pfSense Plus version 26.03.1, pfSense CE version 2.8.1, and earlier versions of both. III. Impact Users with access to the Kea settings can effectively run arbitrary external commands and administrators may not realize they have granted that level of access to users when delegating access to DHCP server configuration pages. IV. Workaround To help mitigate the problem on older releases, use one or more of the following: * Limit access to the affected pages to trusted administrators only. V. Solution Users can upgrade to pfSense Plus software version 26.07 or later, or pfSense CE software versions after 2.8.1 when available. This upgrade may be performed in the web interface or from the console. See https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide.html Users on pfSense Plus version 26.03.1 and pfSense CE version 2.8.1 may apply the fix from the recommended patches list in the System Patches package after installing or updating the System Patches package. Users may also manually apply the relevant changes using the System Patches package on earlier versions, or by manually making similar changes to the affected files if the patches do not apply directly. See https://docs.netgate.com/pfsense/en/latest/development/system-patches.html After upgrading or applying the patch, there are additional privileges available which control access to Kea custom JSON configuration fields. Users with restricted access will not have access to these fields by default. If administrators want to delegate that access, they can add the new privileges to groups or users manually as needed. VI. Correction details The following list contains the correction revision commit ID for each affected item. Branch/path Revision - - ------------------------------------------------------------------------- plus/plus-master adb5bb09ae96ccde8f54740f723fd255713486df plus/plus-RELENG_26_07 05d066d980745236cd71cbbf965a867a34b82fea pfSense/master adb5bb09ae96ccde8f54740f723fd255713486df - - ------------------------------------------------------------------------- VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE40XvjEU56XSUPIMdE7mH/ZIU+NoFAmp+HsUACgkQE7mH/ZIU +Npwgg/+L6V/tHVWTYJTC6demI0mCYQQVbRqumd+PzFzkkz6pME4gBX5J+FJ8SAO E/SlnK1OQ/zZgD2YYshECbWMlKr5bMKrkoA1B0b4es8R5qDspqCTlWKBmNJUIBc+ id9acTo5qsh5l77fTP734u4TIqnblGCTJgTyWgQErdGGEFhUs6JI7TJ0FvZzsZqt 7JWIsMSYkt8OlNdenRbj2YEDBfstP5BzKqPgaaP/4xu6bViHRZAq8l93xkRt1Jx3 +ek552BEDH8WOA7hOXorRSwIkGSlobYFGvc1ZrrhKkHpQ7cpHQS9BmVtXuGFaohi vsX8EmEO1b9XOEX5f2CC2vFUamMmAsccP9VC2OswslaK+B6E1r6VW/zMG7y/2Aeh Rcq7/VrS2S0hyhAEfFBj+jlKzWdw4Jxt85nnUHCraXk3atzHxckkJx8bgVPyYL16 5v705qRVVrLTiDRgwpsg7kK3go6G/Hog4gCbPxcLc/URpSPgfQCqZsR+oqtyW9k/ 0ygsrYR4i1xwhxHMwZ4mv97RN+rOg5eTphdg/0k1IKy+SxnxMhmfaz152b90929b yld7uimIxEByiXPCxI7ERL8FlDKWZmpmmEp3ntt93KXQJcpFIEFXXE6wi0IciMLs 8afvtydza3Smov6k4FVPBlcah2ikMo9pcwXUdPJ9GzsipuxFe5E= =m1va -----END PGP SIGNATURE-----