---
id: "CVE-2026-116186"
kind: "vulnerability"
aliases: ["CVE-2026-116186"]
title: "OpenRemote: gateway events can alter or delete assets in other realms"
severity: "low"
cvss: 2.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["iot", "multi-tenant", "openremote", "runtime", "self-hosted"]
not_affected_if: ["no-edge-gateways", "single-realm-deployment", "version-1.31.0-or-later"]
published_at: "2026-10-25T14:16:58+00:00"
first_seen_at: "2026-10-25T14:41:23+00:00"
updated_at: "2026-10-25T14:44:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116186", "first_seen_at": "2026-10-25T14:41:23+00:00"}]
---

# OpenRemote: gateway events can alter or delete assets in other realms

OpenRemote core before 1.31.0 does not check realm or gateway ownership on inbound edge gateway events, and maps asset IDs with a reversible transform. A party controlling a registered gateway can overwrite attributes on, or delete, assets belonging to any tenant realm.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed openremote-manager version; it is affected if it is below `1.31.0`.
- unknown

## Fix

- Upgrade openremote-manager to `1.31.0` or later.
- unknown

## Timeline

- 2026-10-25T14:41:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116186

## From the sources

OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image IDs in AttributeEvent or DELETE AssetEvent messages to overwrite attributes on, or delete, assets in any realm, breaking tenant isolation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_