CVE-2026-116186 Details
Description
OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image IDs in AttributeEvent or DELETE AssetEvent messages to overwrite attributes on, or delete, assets in any realm, breaking tenant isolation.
A vulnerability exists in OpenRemote core (openremote-manager) versions prior to 1.31.0, where the application fails to enforce proper authorization on inbound edge gateway events. The issue arises because event asset IDs are mapped using a reversible transformation that can be exploited by an attacker controlling a registered gateway. This allows the attacker to craft IDs that overwrite attributes or delete assets in any realm, thereby violating tenant isolation.
To address this vulnerability, OpenRemote should implement checks to ensure that inbound gateway events only affect assets that are descendants of the gateway and within the same realm. This can be done by validating the mapped asset IDs against the gateway's asset ID map before processing the events.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 25, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openremote/core/security/advisories/GHSA-8pjc-wq2p-3xr4 | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/openremote/core/security/advisories/GHSA-8pjc-wq2p-3xr4 | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/openremote-before-1.31.0-gateway-authorization-bypass-via-reversible-mapassetid | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenRemote | < 1.31.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 25, 2026 | New CVE Received | [email protected] |