REMS · CVE-2026-126769 · Other
NO FIX YET · SEE WHAT TO DO
OpsTree REMS (AI observability platform) through 1.0.0 serves its Governance API (/api/v1/databases) without authentication checks. A request with no Authorization header, an invalid token or a tampered JWT returns stored database hosts, usernames and passwords. The researcher says the vendor has patched it but gives no version.
first public Nov 11, 2026 · 1 public exploit · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any deployment of OpsTree REMS up to and including 1.0.0 that exposes its Governance API over a network is exposed, because the endpoints skip authentication checks. Teams that run REMS only on a private, unreachable network with no external access are less exposed, but the sources do not say how the API is reached in typical installs.
Not affected if network-isolated, not-deployed
Who cares database-credentials, observability, opstree, rems, self-hosted
Authorization: Bearer invalid_tokenOpsTree REMS through 1.0.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access Governance API endpoints, including /api/v1/databases. Attackers can send requests without an Authorization header, or with invalid or tampered JWT tokens, to retrieve stored database hosts, usernames, and passwords.
This page as .md ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.