CVE-2026-116184 Details
Description
OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network.
An authorization bypass vulnerability has been identified in OpenRemote versions prior to 1.31.0. This vulnerability allows realm administrators to impersonate gateways in other realms. The issue arises because the GatewayService only verifies the gateway ID without considering the realm. Administrators with the WRITE:ADMIN role in one realm can create a service user that mimics another realm's gateway ID. This enables them to overwrite the gateway's descendant assets and establish SSH tunnels into the local network of the gateway.
Users are advised to update OpenRemote to version 1.31.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 25, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openremote/core/security/advisories/GHSA-2j4x-qh6q-q8mm | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/openremote-before-1.31.0-cross-realm-gateway-impersonation-via-websocket | [email protected] | AdvisoryPartial Content |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenRemote | < 1.31.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 25, 2026 | New CVE Received | [email protected] |