CVE-2026-116186 in OpenRemote
Summary
by MITRE • 10/25/2026
OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image IDs in AttributeEvent or DELETE AssetEvent messages to overwrite attributes on, or delete, assets in any realm, breaking tenant isolation.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in OpenRemote core versions prior to 1.31.0 represents a critical failure in access control mechanisms within the edge computing architecture of the platform. Specifically, the openremote-manager component fails to enforce proper authorization checks when processing inbound events originating from registered edge gateways. In typical IoT deployments, edge gateways act as intermediaries that collect data from local devices and forward it to central management systems. The security model relies on strict tenant isolation, ensuring that a gateway associated with one specific realm or organization cannot influence assets belonging to another. However, the absence of realm-level authorization for these inbound events allows any registered gateway to interact with resources outside its designated scope. This flaw fundamentally undermines the multi-tenancy architecture, as the system trusts the source identity without validating whether the actions requested are permitted within that tenant's context.
The technical root cause lies in how asset identifiers are mapped and processed during event transmission. The vulnerability exploits a reversible transformation function known as GatewayConnector.mapAssetId. This function is designed to map internal asset IDs to external or gateway-specific identifiers, but it operates without sufficient cryptographic binding or irreversible hashing mechanisms that would prevent tampering. Because the mapping logic allows for pre-image reconstruction, an attacker who controls a legitimate registered gateway can reverse-engineer the identifier scheme. By crafting specific AttributeEvent or DELETE AssetEvent messages containing these reversed asset IDs, the attacker can target assets in any realm within the system. The manager component accepts these events and applies them to the targeted resources because it lacks validation logic to verify that the requesting gateway has permission to modify those specific assets based on their current realm assignment.
The operational impact of this vulnerability is severe, leading directly to a complete breakdown of tenant isolation. An attacker with access to even a single compromised or maliciously registered edge gateway can escalate privileges to perform unauthorized actions across the entire platform. This includes overwriting critical configuration attributes for devices in other tenants and deleting assets entirely. Such capabilities enable data exfiltration through manipulation of sensor readings, disruption of services by removing device records, and potential lateral movement within the IoT infrastructure. The ability to delete assets may also lead to denial-of-service conditions or force administrators into recovery modes that consume significant operational resources. Furthermore, because edge gateways are often deployed in less secure physical environments, this vulnerability exposes the core management system to risks originating from the network perimeter rather than just internal threats.
This flaw aligns with CWE-269, which describes Improper Privilege Control, as it involves a user or process possessing insufficient privileges for an intended action within its security context. Additionally, it relates to CWE-749, Exposed Dangerous Method or Function, due to the exposure of internal mapping logic that facilitates unauthorized access. From a tactical perspective, this vulnerability supports techniques found in the MITRE ATT&CK framework under Privilege Escalation and Defense Evasion, as an attacker can leverage legitimate gateway credentials to bypass security boundaries. To mitigate this issue, organizations must upgrade immediately to OpenRemote version 1.31.0 or later where these authorization checks have been implemented. Until upgrading is possible, administrators should restrict network access to edge gateways using strict firewall rules and monitor event logs for anomalous patterns of asset modification originating from unexpected gateway IDs. Implementing additional validation layers that verify realm ownership before processing any inbound events would also provide a compensating control against this specific attack vector.