CVE-2026-124436: high-severity vulnerability in openremote core
OpenRemote before 1.32.2 Improper Authorization Allows Realm Admins to Modify Global Resources
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 0.4%
OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resources by calling admin endpoints lacking super administrator checks. Attackers can change the global keycloakUrl via /configuration/manager to redirect other realms' console authentication for credential phishing, inject CSS, replace map tiles, and delete logs.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N
Affected products
openremote · coreRelated CVEs — openremote core
In the same product, most dangerous first.
CVE-2026-116184LOWOpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via WebsocketEPSS 0.2%CVE-2026-116186LOWOpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetIdEPSS 0.2%CVE-2026-116185MEDIUMOpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfosEPSS 0.2%CVE-2026-124435MEDIUMOpenRemote before 1.32.2 Stored XSS via Manager Configuration Image UploadEPSS 0.2%