---
id: "CVE-2026-124436"
page: "https://infrastack.ai/live/CVE-2026-124436"
kind: "vulnerability"
aliases: ["CVE-2026-124436"]
title: "OpenRemote: realm admins can change global settings and redirect logins"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "iot", "openremote", "self-hosted"]
not_affected_if: ["version-1.32.2-or-later"]
published_at: "2026-11-08T14:18:10+00:00"
first_seen_at: "2026-11-08T14:48:38+00:00"
updated_at: "2026-11-08T14:49:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124436", "first_seen_at": "2026-11-08T14:48:38+00:00"}]
exploit_sources: []
---

# OpenRemote: realm admins can change global settings and redirect logins

Link for people: https://infrastack.ai/live/CVE-2026-124436 (this .md is for agents)

OpenRemote before 1.32.2 lets a realm administrator call admin endpoints that lack super administrator checks. That lets them change global settings such as the Keycloak URL, which can redirect other realms' console logins to a phishing page, along with CSS injection, map tile replacement, and log deletion.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenRemote version in use; versions before `1.32.2` are listed as affected.
- Review which accounts hold realm administrator rights, since those are the accounts that can reach the flawed endpoints.

## Fix

- OpenRemote: move to `1.32.2` or later.

## Timeline

- 2026-11-08T14:48:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124436

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openremote/core/security/advisories/GHSA-gf33-2772-8gw3
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openremote-before-1.32.2-improper-authorization-allows-realm-admins-to-modify-global-resources

## From the sources

OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resources by calling admin endpoints lacking super administrator checks. Attackers can change the global keycloakUrl via /configuration/manager to redirect other realms' console authentication for credential phishing, inject CSS, replace map tiles, and delete logs.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_