---
id: "CVE-2026-126769"
page: "https://infrastack.ai/live/CVE-2026-126769"
kind: "vulnerability"
aliases: ["CVE-2026-126769"]
title: "OpsTree REMS: missing authentication exposes stored database credentials to anyone"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "REMS", "fixed": [], "affected": "<= 1.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["database-credentials", "observability", "opstree", "other", "rems", "self-hosted"]
not_affected_if: ["network-isolated", "not-deployed"]
published_at: "2026-11-11T19:17:37+00:00"
first_seen_at: "2026-11-11T19:28:46+00:00"
updated_at: "2026-11-11T19:32:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126769", "first_seen_at": "2026-11-11T19:28:46+00:00"}, {"source": "analyst", "url": "https://gist.github.com/neelkotnis/3fc4a8587179a8691ed89056ea7df076", "first_seen_at": "2026-11-11T19:32:15+00:00", "cites": ["https://gist.github.com/neelkotnis/3fc4a8587179a8691ed89056ea7df076", "https://gist.github.com/neelkotnis/493d542098b328570f821dc152146732"]}]
exploit_sources: [{"type": "poc", "url": "https://gist.github.com/neelkotnis/493d542098b328570f821dc152146732"}]
---

# OpsTree REMS: missing authentication exposes stored database credentials to anyone

Link for people: https://infrastack.ai/live/CVE-2026-126769 (this .md is for agents)

OpsTree REMS (AI observability platform) through 1.0.0 serves its Governance API (/api/v1/databases) without authentication checks. A request with no Authorization header, an invalid token or a tampered JWT returns stored database hosts, usernames and passwords. The researcher says the vendor has patched it but gives no version.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:REMS affected <= 1.0.0 fixed no fixed version listed

## How to check

From a host that can reach REMS, run: curl -i https://<rems-host>/api/v1/databases with no Authorization header, then with 'Authorization: Bearer invalid_token'. HTTP 200 with a database list means exposed. Also check whether the API is reachable from the internet or untrusted networks.

## Fix

Researcher's advisory says OpsTree patched authentication enforcement, but no fixed version is published in the sources. Update REMS to the latest OpsTree release and ask OpsTree to confirm the version. Until then, restrict network access to the REMS API, and rotate any database credentials stored in REMS if it was reachable by untrusted parties.

## Timeline

- 2026-11-11T19:28:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126769
- 2026-11-11T19:32:15+00:00 analyst https://gist.github.com/neelkotnis/3fc4a8587179a8691ed89056ea7df076 — VulnCheck advisory plus researcher gist (Kotnis, Sep 2026): /api/v1/* Governance API accepts no/invalid/tampered JWT. Researcher says vendor patched, but no fixed version number or vendor page found; nothing marked verified. Related CORS issue (gist REMS-CVE-9) noted. No exploitation reports found.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-missing-authentication-via-api-v1-databases-governance-api
- [mentions] REMS-CVE-9: Permissive CORS on Governance API (researcher advisory, related) https://gist.github.com/neelkotnis/3fc4a8587179a8691ed89056ea7df076
- [poc] REMS-CVE-5: Unauthenticated Access to Governance API (researcher advisory) https://gist.github.com/neelkotnis/493d542098b328570f821dc152146732

## From the sources

OpsTree REMS through 1.0.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access Governance API endpoints, including /api/v1/databases. Attackers can send requests without an Authorization header, or with invalid or tampered JWT tokens, to retrieve stored database hosts, usernames, and passwords.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_