Live › vulnerability › CVE-2026-116184
Go to dashboardOpenRemote before 1.31.0 checks only the gateway ID, not the realm, so a realm admin can create a service user named after another realm's gateway. That lets them overwrite the other gateway's descendant assets and open SSH tunnels into its local network.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Multi-realm OpenRemote deployments where gateways connect to the platform and some realm administrators are not fully trusted with other realms. The sources do not say whether single-realm installs are affected. Single-realm deployments or installs already on or later can skip it.
1.31.0No product ranges from the sources yet.
1.31.0 are affected.1.31.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network.
This page as .md · .json · in your agent: get_signal("CVE-2026-116184")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.