CVE-2026-114661 in OpenRemote
Summary
by MITRE • 10/22/2026
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open persistent bidirectional TCP circuits into an edge gateway's network or tear down operator tunnels.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in OpenRemote versions prior to 1.31.0 represents a critical failure in access control mechanisms within the GatewayServiceResource component. This flaw is classified as a missing authorization issue, specifically falling under CWE-285: Improper Authorization. The core technical defect lies in the application's inability to verify whether an authenticated user possesses the necessary administrative privileges before executing sensitive operations on gateway tunnels. Consequently, any individual who can successfully authenticate to the system, regardless of their assigned role or permission level, is granted unrestricted control over the lifecycle and configuration of gateway tunnel connections. This lack of server-side enforcement allows non-administrative users to bypass intended security boundaries that should restrict such high-impact actions exclusively to privileged accounts.
From a technical perspective, the exploitation vector involves sending HTTP POST or DELETE requests directly to the gateway tunnel endpoint managed by GatewayServiceResource. A malicious actor with valid credentials can initiate these requests to start new persistent bidirectional TCP circuits into an edge gateway's internal network infrastructure. Alternatively, they may issue deletion commands to tear down existing operator tunnels that are actively facilitating legitimate communication between remote devices and central management systems. The persistence of the opened TCP circuits means that once established, these connections remain active until explicitly terminated or disconnected by a timeout mechanism, providing a sustained foothold within the targeted environment. This capability effectively transforms standard user accounts into powerful entry points for lateral movement and network infiltration.
The operational impact of this vulnerability is severe, as it compromises both the confidentiality and integrity of the IoT infrastructure managed by OpenRemote. By opening persistent bidirectional TCP circuits, an attacker can potentially access internal services, databases, or other connected devices that are not exposed to the public internet but are reachable through the edge gateway. This creates a direct pathway for data exfiltration, command injection into industrial control systems, or further pivoting within the corporate network. Furthermore, the ability to tear down operator tunnels disrupts normal operations by severing legitimate connections between field devices and their management consoles. This denial of service capability can lead to significant operational downtime, loss of telemetry data, and an inability to monitor or manage critical assets in real-time, thereby affecting business continuity and safety protocols dependent on these systems.
To mitigate this risk, organizations running OpenRemote versions earlier than 1.31.0 must immediately upgrade to the patched version where proper role-based access control checks have been implemented within GatewayServiceResource. Until an upgrade is feasible, administrators should implement network-level controls such as firewall rules or reverse proxy configurations that restrict direct HTTP access to the gateway tunnel endpoints exclusively from trusted administrative IP addresses. Additionally, enforcing strict multi-factor authentication and monitoring for anomalous POST or DELETE activity on these specific API endpoints can help detect potential exploitation attempts in real-time. Regular audits of user roles and permissions are also recommended to ensure that no unnecessary privileges are granted to standard users who do not require administrative access to gateway configurations.
This vulnerability aligns with the MITRE ATT&CK framework, particularly under techniques related to Initial Access via Valid Accounts (T1078) and Lateral Movement using Remote Services or Network Device CLI commands if the TCP circuits allow further exploitation of connected devices. It also reflects common patterns found in CWE-269: Improper Privilege Management, where the system fails to enforce separation of duties between administrative functions and standard user operations. Addressing this issue requires a holistic approach that combines software patching with robust identity governance practices to prevent unauthorized escalation of privileges within IoT management platforms.