by Kastro
Paper/Archive/CVE-2026-114661

CVE-2026-114661

openremote openremote — OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints

EPSS 0.4%public exploitCVSS 9.0
critical.is priorityof 100
43
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 28.6.286 × 205.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open persistent bidirectional TCP circuits into an edge gateway's network or tear down operator tunnels.

Affected

ProductAffectedFixed inSource
openremote1.2.0 – < 1.31.01.31.0CNA

Scores by source

VulnCheck (CNA)9.0CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H
VulnCheck (CNA)8.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/openremote/core/security/advisories/GHSA-5h8w-vg25-fw38writeupvulncheck.com/advisories/openremote-1.2.0-before-1.31.0-missing-authorization-in-gateway-tunnel-endpoints