{"id":"CVE-2026-126770","kind":"vulnerability","aliases":["CVE-2026-126770"],"related":[],"title":"OpsTree REMS: database Test Connection lets authenticated users probe internal hosts","description":"OpsTree REMS through 1.0.0 contains a server-side request forgery vulnerability that allows authenticated users to make the backend connect to arbitrary destinations through the database Test Connection feature. Attackers can set a database entry's host and port to localhost, internal addresses, or attacker-controlled servers to probe internal hosts and ports reachable from the REMS server.","summary":"OpsTree REMS through 1.0.0 has a server-side request forgery flaw in its database Test Connection feature. A logged-in user can make the REMS server connect to arbitrary hosts and ports, including internal addresses, to probe what the server can reach.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpsTree REMS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ops-tree-rems","other","self-hosted"],"not_affected_if":["auth-required","no-user-accounts"],"how_to_check":"- Check whether the REMS version in use is `1.0.0` or earlier.\n- Check whether users with ordinary accounts can reach the database Test Connection feature.","fix":null,"status":"open","published_at":"2026-11-11T19:17:37+00:00","first_seen_at":"2026-11-11T19:28:46+00:00","triaged_at":"2026-11-11T19:30:31+00:00","updated_at":"2026-11-11T19:30:31+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T19:30:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"OpsTree REMS: database Test Connection lets authenticated users probe internal hosts","impact":"low","summary":"OpsTree REMS through 1.0.0 has a server-side request forgery flaw in its database Test Connection feature. A logged-in user can make the REMS server connect to arbitrary hosts and ports, including internal addresses, to probe what the server can reach.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ops-tree-rems","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker maps internal hosts and ports reachable from the REMS server","analyst_note":"Confirm the fixed version and any patch from the NVD or vendor page; the sources give no fix.","how_to_check":"- Check whether the REMS version in use is `1.0.0` or earlier.\n- Check whether users with ordinary accounts can reach the database Test Connection feature.","plain_action":"","product_name":"OpsTree REMS","needs_analyst":true,"not_affected_if":["auth-required","no-user-accounts"],"who_is_affected":"Teams running OpsTree REMS version 1.0.0 or earlier where authenticated users can create or edit database entries and run Test Connection. The flaw lets such users reach internal hosts and ports from the REMS server. Instances where only trusted administrators hold accounts carry less exposure.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000738,"input_tokens":4600,"output_tokens":556,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126770':14A,17A '-2026':13A,16A '1.0.0':31B,75C 'address':64B,115C 'allow':85C 'arbitrari':58B,94C 'attack':102C,118C 'attacker-control':117C 'authent':7A,86C 'backend':91C 'connect':5A,44B,56B,92C,100C 'contain':76C 'control':119C 'cve':12A,15A 'databas':3A,42B,98C,106C 'destin':95C 'entri':107C 'featur':45B,101C 'flaw':39B 'forgeri':38B,82C 'host':11A,27B,59B,109C,124C 'includ':62B 'intern':10A,63B,114C,123C 'let':6A 'localhost':113C 'log':48B 'logged-in':47B 'make':52B,89C 'op':21B 'ops-tree-rem':20B 'opstre':1A,28B,72C 'opstree':18A 'port':61B,111C,126C 'probe':9A,66B,122C 'reach':71B 'reachabl':127C 'rem':2A,23B,29B,54B,73C,130C 'rems':19A 'request':37B,81C 'self':26B 'self-host':25B 'server':35B,55B,69B,79C,120C,131C 'server-sid':34B,78C 'set':104C 'side':36B,80C 'test':4A,43B,99C 'tree':22B 'user':8A,50B,87C 'vulner':83C","nicknames":[],"mitigations":[],"who_affected":"Teams running OpsTree REMS version 1.0.0 or earlier where authenticated users can create or edit database entries and run Test Connection. The flaw lets such users reach internal hosts and ports from the REMS server. Instances where only trusted administrators hold accounts carry less exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["opstreerems","rems"],"ptokens":["opstree","rems"],"labels":["medium","opstreerems","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126770':14A,17A '-2026':13A,16A 'authent':7A 'connect':5A 'cve':12A,15A 'databas':3A 'host':11A 'intern':10A 'let':6A 'opstre':1A 'opstree':18A 'probe':9A 'rem':2A 'rems':19A 'test':4A 'user':8A","search_b":"'1.0.0':31B 'address':64B 'arbitrari':58B 'connect':44B,56B 'databas':42B 'featur':45B 'flaw':39B 'forgeri':38B 'host':27B,59B 'includ':62B 'intern':63B 'log':48B 'logged-in':47B 'make':52B 'op':21B 'ops-tree-rem':20B 'opstre':28B 'port':61B 'probe':66B 'reach':71B 'rem':23B,29B,54B 'request':37B 'self':26B 'self-host':25B 'server':35B,55B,69B 'server-sid':34B 'side':36B 'test':43B 'tree':22B 'user':50B","search_c":"'1.0.0':75C 'address':115C 'allow':85C 'arbitrari':94C 'attack':102C,118C 'attacker-control':117C 'authent':86C 'backend':91C 'connect':92C,100C 'contain':76C 'control':119C 'databas':98C,106C 'destin':95C 'entri':107C 'featur':101C 'forgeri':82C 'host':109C,124C 'intern':114C,123C 'localhost':113C 'make':89C 'opstre':72C 'port':111C,126C 'probe':122C 'reachabl':127C 'rem':73C,130C 'request':81C 'server':79C,120C,131C 'server-sid':78C 'set':104C 'side':80C 'test':99C 'user':87C 'vulner':83C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T19:17:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126770","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126770","severity":null,"published_at":"2026-11-11T19:17:37+00:00","modified_at":"2026-11-11T19:17:37+00:00","first_seen_at":"2026-11-11T19:28:46+00:00","fetched_at":"2026-11-11T19:28:46+00:00","note":null}],"documents":[{"id":128100,"url":"https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-ssrf-via-database-test-connection","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}