Skip to content
CVE PROGRAM SOURCE RECORD2.3 Low

CVE-2026-116186

OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image IDs in AttributeEvent or DELETE AssetEvent messages to overwrite attributes on, or delete, assets in any realm, breaking tenant isolation.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

openremote core

Default version status: unaffected

  • 0 to < 1.31.0affected
  • 1.31.0unaffected
pkg:maven/io.openremote/openremote-manager

References