Search
Find a vulnerability
Search criteria
6 vulnerabilities found for core by openremote
CVE-2026-116186 (GCVE-0-2026-116186)
Vulnerability from nvd – Published: 2026-10-25 13:22 – Updated: 2026-10-25 13:22
VLAI
EPSS
VEX
Title
OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId
Summary
OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image IDs in AttributeEvent or DELETE AssetEvent messages to overwrite attributes on, or delete, assets in any realm, breaking tenant isolation.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openremote/core/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/openremote-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openremote | core |
Affected:
0 , < 1.31.0
(semver)
Unaffected: 1.31.0 (semver) cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:* |
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/io.openremote/openremote-manager",
"product": "core",
"vendor": "openremote",
"versions": [
{
"lessThan": "1.31.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.31.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.31.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Pig-Tail"
},
{
"lang": "en",
"type": "reporter",
"value": "hongshengy"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image IDs in AttributeEvent or DELETE AssetEvent messages to overwrite attributes on, or delete, assets in any realm, breaking tenant isolation."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T13:22:10.154Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-8pjc-wq2p-3xr4)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openremote/core/security/advisories/GHSA-8pjc-wq2p-3xr4"
},
{
"name": "VulnCheck Advisory: OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openremote-before-1.31.0-gateway-authorization-bypass-via-reversible-mapassetid"
}
],
"title": "OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116186",
"datePublished": "2026-10-25T13:22:10.154Z",
"dateReserved": "2026-10-25T12:26:13.488Z",
"dateUpdated": "2026-10-25T13:22:10.154Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116185 (GCVE-0-2026-116185)
Vulnerability from nvd – Published: 2026-10-25 13:22 – Updated: 2026-10-25 13:22
VLAI
EPSS
VEX
Title
OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos
Summary
OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own realm and a victim gateway ID to disclose internal target hosts, ports, and routing data.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openremote/core/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/openremote-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openremote | core |
Affected:
0 , < 1.31.0
(semver)
Unaffected: 1.31.0 (semver) cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:* |
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/io.openremote/openremote-manager",
"product": "core",
"vendor": "openremote",
"versions": [
{
"lessThan": "1.31.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.31.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.31.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Pig-Tail"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms\u0027 gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own realm and a victim gateway ID to disclose internal target hosts, ports, and routing data."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T13:22:09.474Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-p5wh-9wx4-w5f3)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openremote/core/security/advisories/GHSA-p5wh-9wx4-w5f3"
},
{
"name": "VulnCheck Advisory: OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openremote-before-1.31.0-cross-realm-information-disclosure-via-getgatewayactivetunnelinfos"
}
],
"title": "OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116185",
"datePublished": "2026-10-25T13:22:09.474Z",
"dateReserved": "2026-10-25T12:26:13.488Z",
"dateUpdated": "2026-10-25T13:22:09.474Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116184 (GCVE-0-2026-116184)
Vulnerability from nvd – Published: 2026-10-25 13:22 – Updated: 2026-10-25 13:22
VLAI
EPSS
VEX
Title
OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket
Summary
OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openremote/core/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/openremote-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openremote | core |
Affected:
0 , < 1.31.0
(semver)
Unaffected: 1.31.0 (semver) cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:* |
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/io.openremote/openremote-manager",
"product": "core",
"vendor": "openremote",
"versions": [
{
"lessThan": "1.31.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.31.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.31.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "richturner"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm\u0027s gateway ID to overwrite its descendant assets and open SSH tunnels into its local network."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T13:22:08.792Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-2j4x-qh6q-q8mm)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openremote/core/security/advisories/GHSA-2j4x-qh6q-q8mm"
},
{
"name": "VulnCheck Advisory: OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openremote-before-1.31.0-cross-realm-gateway-impersonation-via-websocket"
}
],
"title": "OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116184",
"datePublished": "2026-10-25T13:22:08.792Z",
"dateReserved": "2026-10-25T12:26:13.488Z",
"dateUpdated": "2026-10-25T13:22:08.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116186 (GCVE-0-2026-116186)
Vulnerability from cvelistv5 – Published: 2026-10-25 13:22 – Updated: 2026-10-25 13:22
VLAI
EPSS
VEX
Title
OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId
Summary
OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image IDs in AttributeEvent or DELETE AssetEvent messages to overwrite attributes on, or delete, assets in any realm, breaking tenant isolation.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openremote/core/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/openremote-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openremote | core |
Affected:
0 , < 1.31.0
(semver)
Unaffected: 1.31.0 (semver) cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:* |
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/io.openremote/openremote-manager",
"product": "core",
"vendor": "openremote",
"versions": [
{
"lessThan": "1.31.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.31.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.31.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Pig-Tail"
},
{
"lang": "en",
"type": "reporter",
"value": "hongshengy"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image IDs in AttributeEvent or DELETE AssetEvent messages to overwrite attributes on, or delete, assets in any realm, breaking tenant isolation."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T13:22:10.154Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-8pjc-wq2p-3xr4)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openremote/core/security/advisories/GHSA-8pjc-wq2p-3xr4"
},
{
"name": "VulnCheck Advisory: OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openremote-before-1.31.0-gateway-authorization-bypass-via-reversible-mapassetid"
}
],
"title": "OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116186",
"datePublished": "2026-10-25T13:22:10.154Z",
"dateReserved": "2026-10-25T12:26:13.488Z",
"dateUpdated": "2026-10-25T13:22:10.154Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116185 (GCVE-0-2026-116185)
Vulnerability from cvelistv5 – Published: 2026-10-25 13:22 – Updated: 2026-10-25 13:22
VLAI
EPSS
VEX
Title
OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos
Summary
OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own realm and a victim gateway ID to disclose internal target hosts, ports, and routing data.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openremote/core/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/openremote-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openremote | core |
Affected:
0 , < 1.31.0
(semver)
Unaffected: 1.31.0 (semver) cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:* |
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/io.openremote/openremote-manager",
"product": "core",
"vendor": "openremote",
"versions": [
{
"lessThan": "1.31.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.31.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.31.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Pig-Tail"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms\u0027 gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own realm and a victim gateway ID to disclose internal target hosts, ports, and routing data."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T13:22:09.474Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-p5wh-9wx4-w5f3)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openremote/core/security/advisories/GHSA-p5wh-9wx4-w5f3"
},
{
"name": "VulnCheck Advisory: OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openremote-before-1.31.0-cross-realm-information-disclosure-via-getgatewayactivetunnelinfos"
}
],
"title": "OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116185",
"datePublished": "2026-10-25T13:22:09.474Z",
"dateReserved": "2026-10-25T12:26:13.488Z",
"dateUpdated": "2026-10-25T13:22:09.474Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116184 (GCVE-0-2026-116184)
Vulnerability from cvelistv5 – Published: 2026-10-25 13:22 – Updated: 2026-10-25 13:22
VLAI
EPSS
VEX
Title
OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket
Summary
OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openremote/core/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/openremote-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openremote | core |
Affected:
0 , < 1.31.0
(semver)
Unaffected: 1.31.0 (semver) cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:* |
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/io.openremote/openremote-manager",
"product": "core",
"vendor": "openremote",
"versions": [
{
"lessThan": "1.31.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.31.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.31.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "richturner"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm\u0027s gateway ID to overwrite its descendant assets and open SSH tunnels into its local network."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T13:22:08.792Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-2j4x-qh6q-q8mm)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openremote/core/security/advisories/GHSA-2j4x-qh6q-q8mm"
},
{
"name": "VulnCheck Advisory: OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openremote-before-1.31.0-cross-realm-gateway-impersonation-via-websocket"
}
],
"title": "OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116184",
"datePublished": "2026-10-25T13:22:08.792Z",
"dateReserved": "2026-10-25T12:26:13.488Z",
"dateUpdated": "2026-10-25T13:22:08.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}