CVE-2026-116185mediumCWE-639

CVE-2026-116185: falha de média gravidade em openremote core

OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.2%
OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own realm and a victim gateway ID to disclose internal target hosts, ports, and routing data.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Produtos afetados
openremote · core
CVEs relacionadas — openremote core

No mesmo produto, das mais perigosas para as menos.

CVE-2026-124436HIGHOpenRemote before 1.32.2 Improper Authorization Allows Realm Admins to Modify Global ResourcesEPSS 0.4%CVE-2026-116184LOWOpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via WebsocketEPSS 0.2%CVE-2026-116186LOWOpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetIdEPSS 0.2%CVE-2026-124435MEDIUMOpenRemote before 1.32.2 Stored XSS via Manager Configuration Image UploadEPSS 0.2%