---
id: "CVE-2026-116185"
kind: "vulnerability"
aliases: ["CVE-2026-116185"]
title: "OpenRemote core: authenticated users can read other realms' gateway tunnel data"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["iot", "openremote", "other", "self-hosted"]
not_affected_if: ["openremote-1.31.0-or-later"]
published_at: "2026-10-25T14:16:58+00:00"
first_seen_at: "2026-10-25T14:41:23+00:00"
updated_at: "2026-10-25T14:43:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116185", "first_seen_at": "2026-10-25T14:41:23+00:00"}]
---

# OpenRemote core: authenticated users can read other realms' gateway tunnel data

OpenRemote core before 1.31.0 has an authorization bypass in getGatewayActiveTunnelInfos. An authenticated user can request another realm's gateway ID and see its internal target hosts, ports and routing data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OpenRemote core version against `1.31.0` (unknown how the sources expect this to be read from a deployment)
- unknown for any other check

## Fix

- Upgrade OpenRemote core to `1.31.0` or later
- unknown for any workaround

## Timeline

- 2026-10-25T14:41:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116185

## From the sources

OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own realm and a victim gateway ID to disclose internal target hosts, ports, and routing data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_