Openremote Core vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Openremote Core: 3 record(s), with affected versions and fixes.

CVE-2026-116186 Low · 2.3 CWE-639 Oct 25, 2026

OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId

OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image IDs in AttributeEvent or DELETE AssetEvent messages to overwrite attributes on, or delete, assets in any realm, breaking tenant isolation.

CVE-2026-116185 Medium · 5.0 CWE-639 Oct 25, 2026

OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos

OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own realm and a victim gateway ID to disclose internal target hosts, ports, and routing data.

CVE-2026-116184 Low · 2.1 CWE-639 Oct 25, 2026

OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket

OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network.