CVE-2026-116184
OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket
- State
- Published
- Severity
- 2.1 Low
- Published
- Oct 25, 2026
- Updated
- Oct 25, 2026
- Reserved
- Oct 25, 2026
Description
OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.1 Low | CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
coreopenremote |
|
References
- GitHub Security Advisory (GHSA-2j4x-qh6q-q8mm)vendor-advisory
- VulnCheck Advisory: OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocketthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.