Authorization Bypass in OpenRemote Core Affects Gateway Tunnel Information
CVE-2026-116185

5.3MEDIUM

Key Information:

Vendor

Openremote

Status
Core
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116185?

OpenRemote Core versions prior to 1.31.0 are vulnerable to an authorization bypass issue that permits authenticated users to access gateway tunnel information from other realms. This vulnerability can be exploited through the getGatewayActiveTunnelInfos function, enabling attackers to make unauthorized requests to the gateway tunnel endpoint using a valid realm and a victim's gateway ID. Consequently, sensitive internal data such as target hosts, ports, and routing information may be disclosed, posing significant risks to the security architecture.

Affected Version(s)

core 0 < 1.31.0

core 1.31.0

References

https://github.com/openremote/core/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/openremote-before-1....
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pig-Tail
.