All vulnerabilities
CVE-2026-116184GHSA-2j4x-qh6q-q8mm

core: OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket

openremote core
Open in ThreatlineRecord JSON
CVSS
2.1Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in1.31.0Fixed versionCVE List
Published25 Oct 2026Updated 25 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network.

Text from CVE List

Affected versions 2

  • coreaffected: all versions before 1.31.0CVE List
  • coreunaffected: 1.31.0CVE List

References 2