{"id":"CVE-2026-126769","kind":"vulnerability","aliases":["CVE-2026-126769"],"related":[],"title":"OpsTree REMS: missing authentication exposes stored database credentials to anyone","description":"OpsTree REMS through 1.0.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access Governance API endpoints, including /api/v1/databases. Attackers can send requests without an Authorization header, or with invalid or tampered JWT tokens, to retrieve stored database hosts, usernames, and passwords.","summary":"OpsTree REMS (AI observability platform) through 1.0.0 serves its Governance API (/api/v1/databases) without authentication checks. A request with no Authorization header, an invalid token or a tampered JWT returns stored database hosts, usernames and passwords. The researcher says the vendor has patched it but gives no version.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"REMS","fixed":[],"affected":"<= 1.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["database-credentials","observability","opstree","other","rems","self-hosted"],"not_affected_if":["network-isolated","not-deployed"],"how_to_check":"From a host that can reach REMS, run: curl -i https://<rems-host>/api/v1/databases with no Authorization header, then with 'Authorization: Bearer invalid_token'. HTTP 200 with a database list means exposed. Also check whether the API is reachable from the internet or untrusted networks.","fix":"Researcher's advisory says OpsTree patched authentication enforcement, but no fixed version is published in the sources. Update REMS to the latest OpsTree release and ask OpsTree to confirm the version. Until then, restrict network access to the REMS API, and rotate any database credentials stored in REMS if it was reachable by untrusted parties.","status":"open","published_at":"2026-11-11T19:17:37+00:00","first_seen_at":"2026-11-11T19:28:46+00:00","triaged_at":"2026-11-11T19:29:51+00:00","updated_at":"2026-11-11T19:32:15+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T19:29:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"OpsTree REMS: missing authentication exposes stored database credentials to anyone","impact":"high","summary":"OpsTree REMS through 1.0.0 has Governance API endpoints, including /api/v1/databases, that accept requests with no Authorization header or with invalid or tampered JWT tokens. An unauthenticated remote attacker can read stored database hosts, usernames and passwords.","audience":"businesses","category":"other","nicknames":[],"who_cares":["rems","self-hosted","database-credentials"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Database hosts, usernames and passwords readable by unauthenticated remote attackers","analyst_note":"Confirm the fixed version or patch status and how to check exposure of /api/v1/databases; read the VulnCheck advisory linked in the sources (www.vulncheck.com).","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-deployed","network-isolated"],"who_is_affected":"Any deployment of OpsTree REMS up to and including 1.0.0 that exposes its Governance API over a network is exposed, because the endpoints skip authentication checks. Teams that run REMS only on a private, unreachable network with no external access are less exposed, but the sources do not say how the API is reached in typical installs.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000721,"input_tokens":4594,"output_tokens":524,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version or patch status and how to check exposure of /api/v1/databases; read the VulnCheck advisory linked in the sources (www.vulncheck.com).","search":"'-126769':13A,16A '-2026':12A,15A '/api/v1/databases':39B,95C '1.0.0':34B,78C 'access':90C 'ai':30B 'allow':85C 'anyon':10A 'api':38B,92C 'attack':88C,96C 'authent':4A,41B,82C 'author':47B,102C 'check':42B 'contain':79C 'credenti':8A,20B 'cve':11A,14A 'databas':7A,19B,58B,114C 'database-credenti':18B 'endpoint':93C 'expos':5A 'give':72B 'govern':37B,91C 'header':48B,103C 'host':27B,59B,115C 'includ':94C 'invalid':50B,106C 'jwt':55B,109C 'miss':3A,81C 'observ':21B,31B 'opstre':1A,22B,28B,75C 'password':62B,118C 'patch':69B 'platform':32B 'rem':2A,24B,29B,76C 'remot':87C 'rems':17A 'request':44B,99C 'research':64B 'retriev':112C 'return':56B 'say':65B 'self':26B 'self-host':25B 'send':98C 'serv':35B 'store':6A,57B,113C 'tamper':54B,108C 'token':51B,110C 'unauthent':86C 'usernam':60B,116C 'vendor':67B 'version':74B 'vulner':83C 'without':40B,100C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of OpsTree REMS up to and including 1.0.0 that exposes its Governance API over a network is exposed, because the endpoints skip authentication checks. Teams that run REMS only on a private, unreachable network with no external access are less exposed, but the sources do not say how the API is reached in typical installs.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["rems"],"ptokens":["rems"],"labels":["databasecredentials","high","observability","opstree","other","rems","selfhosted"],"campaign_type":null,"search_a":"'-126769':13A,16A '-2026':12A,15A 'anyon':10A 'authent':4A 'credenti':8A 'cve':11A,14A 'databas':7A 'expos':5A 'miss':3A 'opstre':1A 'rem':2A 'rems':17A 'store':6A","search_b":"'/api/v1/databases':39B '1.0.0':34B 'ai':30B 'api':38B 'authent':41B 'author':47B 'check':42B 'credenti':20B 'databas':19B,58B 'database-credenti':18B 'give':72B 'govern':37B 'header':48B 'host':27B,59B 'invalid':50B 'jwt':55B 'observ':21B,31B 'opstre':22B,28B 'password':62B 'patch':69B 'platform':32B 'rem':24B,29B 'request':44B 'research':64B 'return':56B 'say':65B 'self':26B 'self-host':25B 'serv':35B 'store':57B 'tamper':54B 'token':51B 'usernam':60B 'vendor':67B 'version':74B 'without':40B","search_c":"'/api/v1/databases':95C '1.0.0':78C 'access':90C 'allow':85C 'api':92C 'attack':88C,96C 'authent':82C 'author':102C 'contain':79C 'databas':114C 'endpoint':93C 'govern':91C 'header':103C 'host':115C 'includ':94C 'invalid':106C 'jwt':109C 'miss':81C 'opstre':75C 'password':118C 'rem':76C 'remot':87C 'request':99C 'retriev':112C 'send':98C 'store':113C 'tamper':108C 'token':110C 'unauthent':86C 'usernam':116C 'vulner':83C 'without':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T19:17:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-126769","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126769","severity":null,"published_at":"2026-11-11T19:17:37+00:00","modified_at":"2026-11-11T19:17:37+00:00","first_seen_at":"2026-11-11T19:28:46+00:00","fetched_at":"2026-11-11T19:28:46+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126769:3585","url":"https://gist.github.com/neelkotnis/493d542098b328570f821dc152146732","severity":null,"published_at":"2026-11-11T19:32:15+00:00","modified_at":"2026-11-11T19:32:15+00:00","first_seen_at":"2026-11-11T19:32:15+00:00","fetched_at":"2026-11-11T19:32:15+00:00","note":"VulnCheck advisory plus researcher gist (Kotnis, Sep 2026): /api/v1/* Governance API accepts no/invalid/tampered JWT. Researcher says vendor patched, but no fixed version number or vendor page found; nothing marked verified. Related CORS issue (gist REMS-CVE-9) noted. No exploitation reports found.","cites":["https://gist.github.com/neelkotnis/493d542098b328570f821dc152146732","https://gist.github.com/neelkotnis/3fc4a8587179a8691ed89056ea7df076"]}],"documents":[{"id":128099,"url":"https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-missing-authentication-via-api-v1-databases-governance-api","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":128318,"url":"https://gist.github.com/neelkotnis/493d542098b328570f821dc152146732","title":"REMS-CVE-5: Unauthenticated Access to Governance API (researcher advisory)","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":128319,"url":"https://gist.github.com/neelkotnis/3fc4a8587179a8691ed89056ea7df076","title":"REMS-CVE-9: Permissive CORS on Governance API (researcher advisory, related)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[{"type":"poc","url":"https://gist.github.com/neelkotnis/493d542098b328570f821dc152146732"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}