Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF characters in the aclname or aclaction fields written to access_lists.conf to add local-data, local-zone, or forward-zone directives and control DNS answers served to LAN clients.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 4
- Cpes+1 CPE criteria (now 1)NVD modified 2026-10-19 20:42
- StatusAwaiting Analysis → AnalyzedNVD modified 2026-10-19 20:42
- StatusReceived → Awaiting AnalysisNVD modified 2026-10-15 21:05
- First seenCVSS 5.1NVD modified 2026-10-15 19:17
Affected (CPE criteria) 1
cpe:2.3:a:pfsense:pfsense:*:*:*:*:community:*:*:*
References 5
- https://abraxaslabs.tech/research/pfsense-ce-leftovers Issue Tracking
- https://github.com/abraxas/pfsense-unbound-acl-crlf Third Party Advisory
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/unbound.inc#L1094-L1112 Product
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/services_unbound_acls.php#L121-L142 Product
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-crlf-injection-via-services-unbound-acls-php Third Party Advisory