CVE-2026-116185
Received Received - Intake

Authorization Bypass in OpenRemote Core Reveals Gateway Tunnel Data

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own realm and a victim gateway ID to disclose internal target hosts, ports, and routing data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116185
EUVD
EUVD-2026-109469

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openremote core 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenRemote core before version 1.31.0 has an authorization bypass flaw. Authenticated users can access other realms' gateway tunnel details by calling getGatewayActiveTunnelInfos with their own realm and a victim's gateway ID. This exposes internal routing data like target hosts and ports.

Detection Guidance

Check OpenRemote core versions before 1.31.0. Monitor logs for unauthorized requests to getGatewayActiveTunnelInfos endpoint. Look for unusual access patterns or requests with modified gateway IDs.

Impact Analysis

An attacker with valid credentials could exploit this to gather sensitive network information. This may enable further attacks like lateral movement, data exfiltration, or unauthorized access to internal systems by mapping the network structure.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, fines, or legal consequences due to insufficient access controls and data protection measures.

Mitigation Strategies

Upgrade OpenRemote core to version 1.31.0 or later. Restrict access to the getGatewayActiveTunnelInfos endpoint. Review and audit user permissions to ensure least privilege access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116185. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart