Skip to content
CVE PROGRAM SOURCE RECORD2.1 Low

CVE-2026-116184

OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

openremote core

Default version status: unaffected

  • 0 to < 1.31.0affected
  • 1.31.0unaffected
pkg:maven/io.openremote/openremote-manager

References