CVE-2026-54640 in OpenRemote
Summary
by MITRE • 10/13/2026
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and XMLInputFactory parsers that permit external entity resolution. This incomplete remediation of CVE-2026-40882 leaves the KNX handler unprotected while the parallel Velbus handler is hardened, allowing a regular realm user to read files accessible to the JVM process or cause server-side requests. This issue is fixed in version 1.24.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
OpenRemote serves as an open-source platform for managing internet-of-things devices and automations, relying on various protocol handlers to interface with hardware ecosystems such as KNX and Velbus. A critical security deficiency was identified within the KNXProtocol.startAssetImport method located in the agent source code. This vulnerability stems from the use of Saxon TransformerFactoryImpl and XMLInputFactory parsers during the processing of uploaded ETS project ZIP files, specifically when handling 0.xml components extracted by authenticated users. The core technical flaw lies in the configuration of these XML parsing libraries, which were left with external entity resolution enabled by default or without sufficient restriction. This allows an attacker to exploit Server-Side Request Forgery patterns and arbitrary file read capabilities through maliciously crafted XML entities that reference local system resources or internal network endpoints.
The severity of this issue is compounded by the fact that it represents an incomplete remediation effort related to CVE-2026-40882. While parallel handlers such as the Velbus protocol implementation were hardened against similar injection vectors, the KNX handler was overlooked during the patching process. This inconsistency creates a significant attack surface for regular realm users who possess valid authentication credentials but lack administrative privileges. By leveraging this disparity in security controls across different protocol modules, an attacker can bypass intended restrictions and execute actions that should be prohibited by their role level. The ability to resolve external entities permits the reading of arbitrary files accessible to the Java Virtual Machine process, potentially exposing sensitive configuration data, private keys, or internal system information. Furthermore, the vulnerability facilitates server-side request forgery attacks where the compromised application acts as a proxy for malicious requests directed at internal services that may not be directly exposed to the internet.
From an industry standard perspective, this vulnerability aligns with CWE-611 Improper Restriction of XML External Entity Reference and CWE-94 Server-Side Request Forgery using controlled source parameters. In terms of threat modeling frameworks such as MITRE ATT&CK, these capabilities map to techniques involving Data from Local System Retrieval and Network Service Discovery via the compromised application infrastructure. The impact extends beyond simple data exfiltration; it can serve as a pivot point for lateral movement within internal networks if the server has access to other critical services. To mitigate this risk, organizations must ensure that all XML parsing operations strictly disable external entity resolution by setting features such as http://javax.xml.XMLConstants/feature/disallow-doctype-decl and http://apache.org/xml/features/disallow-doctype-dec to true. Additionally, input validation should be enforced at the application layer to reject any XML content containing DOCTYPE declarations or entity references before they reach the parser. Upgrading OpenRemote to version 1.24.2 is essential as it addresses this incomplete remediation by applying consistent security hardening across all protocol handlers, thereby closing the gap that allowed authenticated users to exploit these parsing flaws.