All vulnerabilities
CVE-2026-116186GHSA-8pjc-wq2p-3xr4

core: OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId

openremote core
Open in ThreatlineRecord JSON
CVSS
2.3Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in1.31.0Fixed versionCVE List
Published25 Oct 2026Updated 25 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image IDs in AttributeEvent or DELETE AssetEvent messages to overwrite attributes on, or delete, assets in any realm, breaking tenant isolation.

Text from CVE List

Affected versions 2

  • coreaffected: all versions before 1.31.0CVE List
  • coreunaffected: 1.31.0CVE List

References 2