CVE-2026-114661
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in…
- Risk score
- 54/100
- CVSS
- 8.5 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open persistent bidirectional …
- Affected
- See advisory
- Fix
- Upgrade the product to 1.31.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.5 high
References
Original description
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open persistent bidirectional TCP circuits into an edge gateway's network or tear down operator tunnels.
Last activity 22 Oct 2026. Patch Forecast updates every hour.