CVE-2026-114661: critical vulnerability in openremote
OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9epss 0.4%
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open persistent bidirectional TCP circuits into an edge gateway's network or tear down operator tunnels.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H
Affected products
openremote · openremoteRelated CVEs — openremote
In the same product, most dangerous first.
CVE-2026-39842CRITICALOpenRemote is Vulnerable to Expression InjectionEPSS 0.9%CVE-2026-66013CRITICALOpenRemote before 1.26.2 Authentication Bypass via Console RegistrationEPSS 0.7%CVE-2026-62238HIGHOpenRemote < 1.26.0 SQL Injection via Crosstab ExportEPSS 0.5%CVE-2026-81679HIGHOpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification APIEPSS 0.4%CVE-2026-63224HIGHOpenRemote has authenticated SQL injection in crosstab datapoint exportsEPSS 0.3%CVE-2026-56784HIGHOpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion EndpointEPSS 0.3%