---
id: "CVE-2026-116184"
kind: "vulnerability"
aliases: ["CVE-2026-116184"]
title: "OpenRemote: realm admins can impersonate gateways in other realms"
severity: "low"
cvss: 2.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "iot", "multi-tenant", "openremote", "self-hosted"]
not_affected_if: ["single-realm", "version-1.31.0-or-later"]
published_at: "2026-10-25T14:16:58+00:00"
first_seen_at: "2026-10-25T14:41:23+00:00"
updated_at: "2026-10-25T14:44:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116184", "first_seen_at": "2026-10-25T14:41:23+00:00"}]
---

# OpenRemote: realm admins can impersonate gateways in other realms

OpenRemote before 1.31.0 checks only the gateway ID, not the realm, so a realm admin can create a service user named after another realm's gateway. That lets them overwrite the other gateway's descendant assets and open SSH tunnels into its local network.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenRemote version in use; versions below `1.31.0` are affected.
- unknown

## Fix

- Upgrade OpenRemote to `1.31.0` or later.

## Timeline

- 2026-10-25T14:41:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116184

## From the sources

OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_