CVE-2026-116184
Received Received - Intake

Authorization Bypass in OpenRemote via Gateway Impersonation

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116184
EUVD
EUVD-2026-109468

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openremote core 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenRemote before version 1.31.0 has an authorization bypass flaw where realm admins can impersonate gateways in other realms. The GatewayService only checks the gateway ID without verifying the realm, allowing attackers with WRITE:ADMIN privileges in one realm to create a service user matching another realm's gateway ID. This lets them overwrite descendant assets and open SSH tunnels into the target realm's network.

Detection Guidance

Check OpenRemote versions before 1.31.0 using commands like 'docker inspect <container_name> | grep OpenRemote' or 'curl -s http://localhost:8080/api/version'. Monitor websocket connections for unauthorized gateway impersonation attempts by reviewing logs in /var/log/openremote/ for suspicious service user creations or SSH tunnel activities.

Impact Analysis

If you are an OpenRemote user running versions before 1.31.0, an attacker with WRITE:ADMIN privileges in your realm could impersonate gateways from other realms. This could lead to unauthorized access to descendant assets, manipulation of gateway settings, and potential network intrusion via SSH tunnels into other realms' local networks.

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized access to sensitive data or systems across realms. For GDPR, it may lead to unauthorized data access or processing. For HIPAA, it could allow unauthorized network access to protected health information. The risk depends on the specific deployment and data handled.

Mitigation Strategies

Upgrade OpenRemote to version 1.31.0 or later immediately. Remove WRITE:ADMIN privileges from users not requiring them. Audit all service users across realms to identify unauthorized gateway impersonations. Block unauthorized websocket connections between realms until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116184. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart