CVE-2026-114661

OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints

State: Published
Severity: 9.0 Critical
Published: Oct 22, 2026
Updated: Oct 28, 2026
Reserved: Oct 21, 2026

Description

OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open persistent bidirectional TCP circuits into an edge gateway's network or tear down operator tunnels.

Scores

CVSS	Score	Vector	Source
4.0	9.0 Critical	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H	VulnCheck
3.1	8.5 High	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
openremoteopenremote	1.2.0 to before 1.31.0Affected 1.31.0Not affected

References

GitHub Security Advisory (GHSA-5h8w-vg25-fw38)vendor-advisory
VulnCheck Advisory: OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpointsthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.