Authorization Bypass in OpenRemote Manager by OpenRemote
CVE-2026-116186

2.3LOW

Key Information:

Vendor

Openremote

Status
Core
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116186?

A vulnerability exists in OpenRemote core (openremote-manager) versions prior to 1.31.0 that fails to properly enforce authorization checks on inbound edge gateway events. An attacker could exploit this weakness if they control a registered gateway, allowing them to craft pre-image IDs in AttributeEvent or DELETE AssetEvent messages. This exploitation could lead to unauthorized overwriting or deletion of asset attributes across any realm, thereby compromising tenant isolation and potentially leading to significant security breaches.

Affected Version(s)

core 0 < 1.31.0

core 1.31.0

References

https://github.com/openremote/core/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/openremote-before-1....
third-party-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pig-Tail
hongshengy
.