CVE-2026-114661 Details
Description
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open persistent bidirectional TCP circuits into an edge gateway's network or tear down operator tunnels.
A missing authorization vulnerability has been identified in OpenRemote versions 1.2.0 prior to 1.31.0. This vulnerability resides in the GatewayServiceResource component, where four out of five gateway tunnel endpoints lack proper authorization controls. As a result, any authenticated user, even those with minimal privileges, can initiate, terminate, and query gateway tunnels. Exploitation of this vulnerability allows for the creation of persistent, bidirectional TCP connections into an edge gateway's network, or the disruption of existing operator tunnels.
Users are advised to upgrade to OpenRemote version 1.31.0 or later, where this vulnerability has been addressed by introducing appropriate authorization roles for tunnel management.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openremote/core/security/advisories/GHSA-5h8w-vg25-fw38 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/openremote/core/security/advisories/GHSA-5h8w-vg25-fw38 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/openremote-1.2.0-before-1.31.0-missing-authorization-in-gateway-tunnel-endpoints | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenRemote | >= 1.2.0, < 1.31.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | [email protected] |