CVE-2026-116186
Received Received - Intake

OpenRemote Core Authorization Bypass via Gateway Events

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image IDs in AttributeEvent or DELETE AssetEvent messages to overwrite attributes on, or delete, assets in any realm, breaking tenant isolation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116186
EUVD
EUVD-2026-109470

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openremote core 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects OpenRemote core versions before 1.31.0. It allows an attacker who controls a registered edge gateway to bypass authorization checks and manipulate assets across all realms. The issue stems from a reversible ID mapping function (GatewayConnector.mapAssetId) that enables crafting events to overwrite attributes or delete assets in any realm, breaking tenant isolation.

Detection Guidance

Check OpenRemote manager logs for unauthorized AttributeEvent or DELETE AssetEvent messages from edge gateways. Inspect GatewayConnector.mapAssetId transformations for unexpected asset ID mappings across realms. Monitor for asset attribute changes or deletions outside expected gateway subtree scopes.

Impact Analysis

If you use OpenRemote versions before 1.31.0, an attacker with gateway credentials could delete or modify assets across all realms, disrupting operations and compromising data integrity. This could lead to unauthorized changes, data loss, or service disruption, especially in multi-tenant environments.

Compliance Impact

This vulnerability breaks tenant isolation, potentially exposing data across realms. For GDPR, it risks unauthorized data access or processing. For HIPAA, it could lead to unauthorized disclosure or modification of protected health information. Compliance may be compromised due to loss of data segregation and integrity.

Mitigation Strategies

Upgrade OpenRemote core to version 1.31.0 or later to fix the reversible ID mapping issue. Implement strict gateway authentication and authorization policies. Review and restrict gateway event permissions to enforce realm and descendant checks. Monitor gateway events for suspicious activity targeting assets outside their designated realms.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116186. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart