CVE-2026-116184 in core
Summary
by MITRE • 10/25/2026
OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in OpenRemote versions prior to 1.31.0 represents a critical authorization bypass flaw rooted in insufficient access control validation within the GatewayService component. This security defect allows authenticated administrators with WRITE privileges in one specific realm to perform actions that should be restricted to their own domain, effectively enabling them to impersonate gateways belonging to different realms. The core technical failure lies in the service's logic for validating gateway identity; it relies exclusively on checking the provided gateway ID without verifying whether that identifier belongs to a resource within the current user’s authorized realm context. This oversight creates a significant gap in multi-tenant isolation, as the system fails to enforce boundary constraints between distinct administrative domains despite their logical separation.
From an operational perspective, this vulnerability poses severe risks to data integrity and network security. An attacker possessing WRITE:ADMIN privileges in one realm can exploit this flaw by creating a service user that mimics the identifier of a gateway located in another realm. Once established, this malicious entity gains the ability to overwrite descendant assets associated with the targeted gateway, leading to potential configuration corruption or loss of critical operational data. Furthermore, the attacker can leverage the compromised gateway identity to open Secure Shell tunnels into the local network segment protected by that target gateway. This capability effectively bypasses perimeter defenses, allowing lateral movement and direct access to internal infrastructure resources that should remain isolated from other administrative domains.
The technical classification of this issue aligns with CWE-269, which denotes Improper Privilege Management, specifically highlighting the failure to enforce proper authorization checks for elevated actions. Additionally, the exploitation technique mirrors tactics found in the MITRE ATT&CK framework under T1078, Valid Accounts, where adversaries use legitimate credentials or identities to gain access and maintain persistence within a system. The ability to impersonate another entity’s identity is also consistent with CWE-269, as it involves assuming privileges that are not explicitly granted for the current context. This type of vulnerability underscores the importance of strict contextual validation in multi-tenant architectures where isolation between tenants or realms is paramount for security compliance and data protection.
To mitigate this risk, organizations running OpenRemote must upgrade to version 1.31.0 or later, which addresses the authorization logic by ensuring that gateway ID checks are coupled with realm context verification. Until an update can be applied, administrators should enforce strict role-based access controls and limit WRITE:ADMIN privileges to only those users who absolutely require them for their specific operational needs. Implementing network segmentation to isolate critical gateways from general administrative networks can also reduce the blast radius of such exploits. Regular audits of user permissions and service account configurations are recommended to detect any unauthorized creation of service users that mimic legitimate gateway identifiers, thereby maintaining robust multi-tenant isolation integrity.