REMS · CVE-2026-126768 · Other
NO FIX YET · SEE WHAT TO DO
OpsTree REMS through 1.0.0 trusts a client-controlled is_local_auth field at login, so the server issues valid JWTs without a correct password. An unauthenticated attacker can log in as the admin account and gain SuperUser administrative access.
first public Nov 11, 2026 · 1 public exploit · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone running OpsTree REMS (the AI observability platform) on-premises at version 1.0.0 or earlier with the web/API reachable. The server trusts a client-supplied is_local_auth flag, so an unauthenticated attacker can get an admin JWT. Teams not running REMS, or with it reachable only on a locked-down internal network, are much less exposed.
Not affected if api-not-reachable, not-running-rems
Who cares admin-panel, auth-bypass, rems, self-hosted
1.0.0 or earlier is affected)1.0.0 and earlier are affectedOpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the client-controlled is_local_auth field. Attackers can send a POST /api/v1/user/login/ request for the admin account with an invalid password and is_local_auth true to gain SuperUser administrative access.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.