CVE-2026-65009 in OpenRemote
Summary
by MITRE • 07/21/2026
OpenRemote versions before 1.26.2 contain an information disclosure vulnerability in the SyslogResource REST endpoint that fails to filter operational logs by realm. Attackers with the read:rules role can access the GET /api/{realm}/syslog/event endpoint to retrieve operational logs from all tenants, exposing asset IDs, agent connection details, rule names, and protocol errors across the multi-tenant deployment.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability under discussion affects OpenRemote versions prior to 1.26.2 and represents a critical information disclosure flaw within the SyslogResource REST endpoint. This weakness stems from inadequate access control implementation that fails to properly filter operational logs based on tenant isolation boundaries. The flaw specifically impacts the GET /api/{realm}/syslog/event endpoint which is designed to provide syslog event data but lacks proper realm-based filtering mechanisms.
The technical implementation of this vulnerability manifests through insufficient authorization checks within the SyslogResource component. When authenticated users with the read:rules role make requests to the syslog endpoint, the system does not validate whether the requesting user has appropriate permissions to access logs from other tenants. This represents a direct violation of multi-tenant security principles and creates an information exposure scenario where cross-tenant data leakage occurs. The vulnerability is classified under CWE-200 as "Information Exposure" with specific implications for privilege escalation and data breach scenarios.
Operational impact of this vulnerability extends significantly across multiple security domains within the OpenRemote platform. Attackers who successfully exploit this flaw gain access to sensitive operational data including asset identification numbers, agent connection parameters, rule configuration details, and protocol error messages from all tenant environments. This exposure creates substantial risk for organizations relying on multi-tenant deployments as it allows malicious actors to gather intelligence about other tenants' infrastructure, network configurations, and security implementations. The compromised information could enable further attacks such as privilege escalation, targeted exploitation of specific agent vulnerabilities, or comprehensive reconnaissance activities.
The vulnerability aligns with several ATT&CK techniques including T1083 (File and Directory Discovery) and T1213 (Data from Information Repositories) as attackers can systematically enumerate and extract operational data across tenant boundaries. Organizations utilizing OpenRemote in cloud environments face particular risk as this flaw undermines the fundamental security assumptions of multi-tenancy. The exposure of agent connection details creates opportunities for lateral movement attacks while rule name disclosure may reveal system architecture and potential attack vectors. This vulnerability demonstrates a critical failure in the principle of least privilege implementation within REST API endpoints.
Mitigation strategies should focus on implementing proper realm-based filtering at the SyslogResource endpoint level to ensure that users can only access logs from their own tenant environment. The recommended fix involves adding comprehensive authorization checks that validate user permissions against the requested realm parameter before returning any operational log data. Organizations should also implement monitoring and alerting mechanisms to detect unusual access patterns to syslog endpoints. Additionally, regular security assessments of REST API implementations should be conducted to identify similar authorization bypass vulnerabilities. The update to version 1.26.2 resolves this issue through proper tenant isolation enforcement in the syslog endpoint implementation.