CVE-2026-116185

medium

Description

OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own realm and a victim gateway ID to disclose internal target hosts, ports, and routing data.

References

https://www.vulncheck.com/advisories/openremote-before-1.31.0-cross-realm-information-disclosure-via-getgatewayactivetunnelinfos

https://github.com/openremote/core/security/advisories/GHSA-p5wh-9wx4-w5f3

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109469

Details

Source: Mitre, NVD

Published: 2026-10-25

Updated: 2026-10-25

Risk Information

CVSS v2

Base Score: 4

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 5

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Severity: Medium

CVSS v4

Base Score: 5.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Severity: Medium