Information Disclosure in OpenRemote via SyslogResource Endpoint

Executive Summary

CVE-2026-65009 is an information disclosure vulnerability in OpenRemote versions before 1.26.2. It affects the SyslogResource REST endpoint, which fails to filter operational logs by realm. Attackers with the read:rules role can access the GET /api/{realm}/syslog/event endpoint to retrieve logs from all tenants, exposing sensitive data like asset IDs, agent connections, rule names, and protocol errors.

Useful 0 Not Useful 0

Detection Guidance

Check if unauthorized users with the read:rules role can access the GET /api/{realm}/syslog/event endpoint. Monitor logs for unusual access patterns or requests to this endpoint from non-admin users. Verify if operational logs from other tenants are being exposed.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows unauthorized access to operational logs across all tenants in a multi-tenant deployment. Attackers could gather sensitive information such as asset details, connection specifics, and errors, enabling further reconnaissance or targeted attacks against other tenants.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing sensitive personal or health-related data. Unauthorized access to operational logs may violate data protection requirements, leading to legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenRemote to version 1.26.2 or later. Restrict the read:rules role to only access logs within the user's realm. Alternatively, restrict the SyslogResource REST endpoint to the READ_LOGS_ROLE.

Useful 0 Not Useful 0