OPSTREE REMS · CVE-2026-126770 · Other
NO FIX YET
OpsTree REMS through 1.0.0 has a server-side request forgery flaw in its database Test Connection feature. A logged-in user can make the REMS server connect to arbitrary hosts and ports, including internal addresses, to probe what the server can reach.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running OpsTree REMS version 1.0.0 or earlier where authenticated users can create or edit database entries and run Test Connection. The flaw lets such users reach internal hosts and ports from the REMS server. Instances where only trusted administrators hold accounts carry less exposure.
Not affected if auth-required, no-user-accounts
Who cares ops-tree-rems, self-hosted
1.0.0 or earlier.No fix yet, per the sources.
OpsTree REMS through 1.0.0 contains a server-side request forgery vulnerability that allows authenticated users to make the backend connect to arbitrary destinations through the database Test Connection feature. Attackers can set a database entry's host and port to localhost, internal addresses, or attacker-controlled servers to probe internal hosts and ports reachable from the REMS server.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.