Live › vulnerability › CVE-2026-116185
Go to dashboardOpenRemote core before 1.31.0 has an authorization bypass in getGatewayActiveTunnelInfos. An authenticated user can request another realm's gateway ID and see its internal target hosts, ports and routing data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Deployments running OpenRemote core before 1.31.0 with more than one realm and gateways that use tunnels. The sources require an authenticated user, and the exposed data is internal host, port and routing information for other realms' gateways. Single-realm deployments where all users are trusted are less exposed. unknown whether the sources name specific default configurations.
No product ranges from the sources yet.
1.31.0 (unknown how the sources expect this to be read from a deployment)1.31.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own realm and a victim gateway ID to disclose internal target hosts, ports, and routing data.
This page as .md · .json · in your agent: get_signal("CVE-2026-116185")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.