{"id":"CVE-2026-116184","kind":"vulnerability","aliases":["CVE-2026-116184"],"related":[],"title":"OpenRemote: realm admins can impersonate gateways in other realms","description":"OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network.","summary":"OpenRemote before 1.31.0 checks only the gateway ID, not the realm, so a realm admin can create a service user named after another realm's gateway. That lets them overwrite the other gateway's descendant assets and open SSH tunnels into its local network.","severity":"low","cvss":2.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","iot","multi-tenant","openremote","self-hosted"],"not_affected_if":["single-realm","version-1.31.0-or-later"],"how_to_check":"- Check the OpenRemote version in use; versions below `1.31.0` are affected.\n- unknown","fix":"- Upgrade OpenRemote to `1.31.0` or later.","status":"open","published_at":"2026-10-25T14:16:58+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:44:21+00:00","updated_at":"2026-10-25T14:44:21+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T14:44:21Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenRemote to `1.31.0` or later.","reach":"network","title":"OpenRemote: realm admins can impersonate gateways in other realms","impact":"high","summary":"OpenRemote before 1.31.0 checks only the gateway ID, not the realm, so a realm admin can create a service user named after another realm's gateway. That lets them overwrite the other gateway's descendant assets and open SSH tunnels into its local network.","category":"infrastructure","nicknames":[],"who_cares":["openremote","self-hosted","iot","multi-tenant"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker overwrites other realm's assets and tunnels into its local network.","analyst_note":"Confirm whether single-realm deployments are affected and get the fixed-version details from the OpenRemote advisory or the NVD page.","how_to_check":"- Check the OpenRemote version in use; versions below `1.31.0` are affected.\n- unknown","needs_analyst":true,"not_affected_if":["version-1.31.0-or-later","single-realm"],"who_is_affected":"Multi-realm OpenRemote deployments where gateways connect to the platform and some realm administrators are not fully trusted with other realms. The sources do not say whether single-realm installs are affected. Single-realm deployments or installs already on `1.31.0` or later can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000594,"input_tokens":3348,"output_tokens":518,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-116184':12A,15A '-2026':11A,14A '1.31.0':27B,71C 'admin':3A,39B,80C,100C 'allow':78C 'anoth':47B,111C 'asset':60B,120C 'attack':97C 'author':74C 'bypass':75C 'check':28B,90C 'contain':72C 'creat':41B,105C 'cve':10A,13A 'descend':59B,119C 'gateway':6A,31B,50B,57B,83C,92C,114C 'gatewayservic':88C 'host':24B 'id':32B,93C,115C 'imperson':5A,82C 'infrastructur':16B 'iot':17B 'let':52B 'local':67B,127C 'multi':19B 'multi-ten':18B 'name':45B,109C 'network':68B,128C 'one':102C 'open':62B,122C 'openremot':1A,21B,25B,69C 'overwrit':54B,117C 'realm':2A,9A,35B,38B,48B,79C,86C,96C,103C,112C 'self':23B 'self-host':22B 'servic':43B,107C 'ssh':63B,123C 'tenant':20B 'tunnel':64B,124C 'user':44B,108C 'vulner':76C 'write':99C","nicknames":[],"mitigations":[],"who_affected":"Multi-realm OpenRemote deployments where gateways connect to the platform and some realm administrators are not fully trusted with other realms. The sources do not say whether single-realm installs are affected. Single-realm deployments or installs already on `1.31.0` or later can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116184","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116184","severity":null,"published_at":"2026-10-25T14:16:58+00:00","modified_at":"2026-10-25T14:16:58+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}