Missing Authorization Vulnerability in OpenRemote Gateway Service
CVE-2026-114661

9CRITICAL

Key Information:

Vendor

Openremote

Status
Openremote
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114661?

OpenRemote prior to version 1.31.0 contains a missing authorization vulnerability in the GatewayServiceResource. This flaw allows any authenticated user to manipulate gateway tunnels without requiring an administrative role. Specifically, attackers can exploit this vulnerability by sending POST or DELETE requests to the gateway tunnel endpoint, enabling them to create persistent bidirectional TCP connections to an edge gateway's network or dismantle operator tunnels, posing significant risks to the integrity and security of the network.

Affected Version(s)

openremote 1.2.0 < 1.31.0

openremote 1.31.0

References

https://github.com/openremote/core/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/openremote-1.2.0-bef...
third-party-advisory

CVSS V4

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

kocaemre
kta1kri
.