CVE-2026-111227 Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php
Authenticated users can inject CRLF characters to manipulate DNS resolver configuration, allowing control over DNS answers served to LAN clients.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111227?
CVE-2026-111227 is a medium-severity vulnerability in Netgate pfSense CE, published on 15 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF characters in the aclname or aclaction fields written to access_lists.conf to add local-data, local-zone, or forward-zone directives and control DNS answers served to LAN clients.
Weakness: CWE-93
Which versions are affected by CVE-2026-111227?
It affects 1 product.
Products include Pfsense Pfsense.
How do I fix CVE-2026-111227?
No fix has been published for CVE-2026-111227 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-111227 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111227 exists.
Other vulnerabilities in Netgate pfSense CE
Sources
Also known as GHSA-4m9r-jxrh-x66q.