CVE-2026-116184: low-severity vulnerability in openremote core
OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 2.1epss 0.2%
OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network.
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
openremote · coreRelated CVEs — openremote core
In the same product, most dangerous first.
CVE-2026-124436HIGHOpenRemote before 1.32.2 Improper Authorization Allows Realm Admins to Modify Global ResourcesEPSS 0.4%CVE-2026-116186LOWOpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetIdEPSS 0.2%CVE-2026-116185MEDIUMOpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfosEPSS 0.2%CVE-2026-124435MEDIUMOpenRemote before 1.32.2 Stored XSS via Manager Configuration Image UploadEPSS 0.2%