CVE-2026-116184: fallo de gravedad baja en openremote core
OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
8Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 2.1epss 0.2%
OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network.
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Productos afectados
openremote · coreCVEs relacionadas — openremote core
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-124436HIGHOpenRemote before 1.32.2 Improper Authorization Allows Realm Admins to Modify Global ResourcesEPSS 0.4%CVE-2026-116186LOWOpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetIdEPSS 0.2%CVE-2026-116185MEDIUMOpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfosEPSS 0.2%CVE-2026-124435MEDIUMOpenRemote before 1.32.2 Stored XSS via Manager Configuration Image UploadEPSS 0.2%