{"id":"CVE-2026-124436","kind":"vulnerability","aliases":["CVE-2026-124436"],"related":[],"title":"OpenRemote: realm admins can change global settings and redirect logins","description":"OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resources by calling admin endpoints lacking super administrator checks. Attackers can change the global keycloakUrl via /configuration/manager to redirect other realms' console authentication for credential phishing, inject CSS, replace map tiles, and delete logs.","summary":"OpenRemote before 1.32.2 lets a realm administrator call admin endpoints that lack super administrator checks. That lets them change global settings such as the Keycloak URL, which can redirect other realms' console logins to a phishing page, along with CSS injection, map tile replacement, and log deletion.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","iot","openremote","self-hosted"],"not_affected_if":["version-1.32.2-or-later"],"how_to_check":"- Check the OpenRemote version in use; versions before `1.32.2` are listed as affected.\n- Review which accounts hold realm administrator rights, since those are the accounts that can reach the flawed endpoints.","fix":"- OpenRemote: move to `1.32.2` or later.","status":"open","published_at":"2026-11-08T14:18:10+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","triaged_at":"2026-11-08T14:49:18+00:00","updated_at":"2026-11-08T14:49:18+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-08T14:49:18Z","model":"claude-haiku-5-5","output":{"fix":"- OpenRemote: move to `1.32.2` or later.","reach":"network","title":"OpenRemote: realm admins can change global settings and redirect logins","impact":"high","summary":"OpenRemote before 1.32.2 lets a realm administrator call admin endpoints that lack super administrator checks. That lets them change global settings such as the Keycloak URL, which can redirect other realms' console logins to a phishing page, along with CSS injection, map tile replacement, and log deletion.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["openremote","self-hosted","iot"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Other realms' console logins are redirected to a phishing page","analyst_note":"","how_to_check":"- Check the OpenRemote version in use; versions before `1.32.2` are listed as affected.\n- Review which accounts hold realm administrator rights, since those are the accounts that can reach the flawed endpoints.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-1.32.2-or-later"],"who_is_affected":"OpenRemote installations running a version before 1.32.2 with multiple realms, where realm administrators are not fully trusted. Single-realm deployments with trusted administrators have a smaller exposure. unknown for any further detail the sources do not give.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000719,"input_tokens":4615,"output_tokens":515,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124436':13A,16A '-2026':12A,15A '/configuration/manager':103C '1.32.2':25B,72C 'access':83C 'admin':3A,31B,90C 'administr':29B,36B,81C,94C 'allow':79C 'along':60B 'attack':96C 'authent':109C 'author':76C 'call':30B,89C 'chang':5A,41B,98C 'check':37B,95C 'consol':54B,108C 'contain':73C 'credenti':111C 'css':62B,114C 'cve':11A,14A 'delet':69B,119C 'endpoint':32B,91C 'global':6A,42B,86C,100C 'host':22B 'improp':75C 'infrastructur':17B 'inject':63B,113C 'iot':18B 'keycloak':47B 'keycloakurl':101C 'lack':34B,92C 'let':26B,39B 'log':68B,120C 'login':10A,55B 'map':64B,116C 'modifi':85C 'openremot':1A,19B,23B,70C 'page':59B 'phish':58B,112C 'realm':2A,28B,53B,80C,107C 'redirect':9A,51B,105C 'replac':66B,115C 'resourc':87C 'self':21B 'self-host':20B 'set':7A,43B 'super':35B,93C 'tile':65B,117C 'url':48B 'via':102C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"OpenRemote installations running a version before 1.32.2 with multiple realms, where realm administrators are not fully trusted. Single-realm deployments with trusted administrators have a smaller exposure. unknown for any further detail the sources do not give.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","iot","openremote","selfhosted"],"campaign_type":null,"search_a":"'-124436':13A,16A '-2026':12A,15A 'admin':3A 'chang':5A 'cve':11A,14A 'global':6A 'login':10A 'openremot':1A 'realm':2A 'redirect':9A 'set':7A","search_b":"'1.32.2':25B 'admin':31B 'administr':29B,36B 'along':60B 'call':30B 'chang':41B 'check':37B 'consol':54B 'css':62B 'delet':69B 'endpoint':32B 'global':42B 'host':22B 'infrastructur':17B 'inject':63B 'iot':18B 'keycloak':47B 'lack':34B 'let':26B,39B 'log':68B 'login':55B 'map':64B 'openremot':19B,23B 'page':59B 'phish':58B 'realm':28B,53B 'redirect':51B 'replac':66B 'self':21B 'self-host':20B 'set':43B 'super':35B 'tile':65B 'url':48B","search_c":"'/configuration/manager':103C '1.32.2':72C 'access':83C 'admin':90C 'administr':81C,94C 'allow':79C 'attack':96C 'authent':109C 'author':76C 'call':89C 'chang':98C 'check':95C 'consol':108C 'contain':73C 'credenti':111C 'css':114C 'delet':119C 'endpoint':91C 'global':86C,100C 'improp':75C 'inject':113C 'keycloakurl':101C 'lack':92C 'log':120C 'map':116C 'modifi':85C 'openremot':70C 'phish':112C 'realm':80C,107C 'redirect':105C 'replac':115C 'resourc':87C 'super':93C 'tile':117C 'via':102C 'vulner':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-23T12:42:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124436","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124436","severity":null,"published_at":"2026-11-08T14:18:10+00:00","modified_at":"2026-11-08T14:18:10+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","fetched_at":"2026-11-08T14:48:38+00:00","note":null}],"documents":[{"id":102056,"url":"https://github.com/openremote/core/security/advisories/GHSA-gf33-2772-8gw3","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-23T12:42:02+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102057,"url":"https://www.vulncheck.com/advisories/openremote-before-1.32.2-improper-authorization-allows-realm-admins-to-modify-global-resources","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}