Live › vulnerability › CVE-2026-116186
Go to dashboardOpenRemote core before 1.31.0 does not check realm or gateway ownership on inbound edge gateway events, and maps asset IDs with a reversible transform. A party controlling a registered gateway can overwrite attributes on, or delete, assets belonging to any tenant realm.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Teams running self-hosted OpenRemote with multiple realms where edge gateways are registered and connected to the manager. Single-realm deployments with no untrusted gateways have a much smaller exposure. The sources do not say which gateway configurations are most exposed.
No product ranges from the sources yet.
1.31.0.1.31.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image IDs in AttributeEvent or DELETE AssetEvent messages to overwrite attributes on, or delete, assets in any realm, breaking tenant isolation.
This page as .md · .json · in your agent: get_signal("CVE-2026-116186")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.