Live › vulnerability › CVE-2026-114661
Go to dashboardOpenRemote versions from 1.2.0 before 1.31.0 let any authenticated user start, stop and query gateway tunnels without an admin role. An attacker can open persistent bidirectional TCP tunnels into an edge gateway's network or tear down tunnels operators rely on.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| openremote | other | >= 1.2.0, < 1.31.0 | 1.31.0 |
Check the OpenRemote version running on the manager (1.2.0 up to but not including 1.31.0 is affected).
1.31.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open persistent bidirectional TCP circuits into an edge gateway's network or tear down operator tunnels.
This page as .md · .json · in your agent: get_signal("CVE-2026-114661")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.