CVE-2026-67310 in OpenRemote
Summary
by MITRE • 08/01/2026
OpenRemote (org.openremote:openremote) versions <= 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream().findFirst() on a HashSet of realms from the request, rather than all realms. Because HashSet iteration order is non-deterministic, an authenticated attacker who includes alarm-asset links from both their own realm and a victim realm can, with roughly 50% probability per request (retryable), persist cross-tenant links and disclose victim asset names (returned via @Formula fields) through GET requests on the attacker's own alarm. Fixed in 1.27.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/01/2026
The OpenRemote vulnerability represents a critical insecure direct object reference flaw that undermines tenant isolation within the application's multi-tenant architecture. This weakness exists specifically in the setAssetLinks endpoint of the AlarmResourceImpl class, where the security validation mechanism fails to properly authenticate all realms associated with a request rather than just validating a single randomly selected realm from a collection. The vulnerability stems from the implementation's reliance on realms.stream().findFirst() method call against a HashSet containing multiple realms, creating a fundamental security gap that allows attackers to bypass proper access controls. The non-deterministic iteration order of HashSet collections means that the validation process may inadvertently accept links from unauthorized realms while rejecting legitimate ones from the attacker's own realm, creating a probabilistic attack surface that can be exploited through careful request construction.
The technical exploitation of this vulnerability occurs when an authenticated attacker crafts requests that include alarm-asset links spanning both their own realm and a victim realm. Through repeated requests, the attacker can achieve approximately 50% probability of successfully persisting cross-tenant links, effectively enabling them to manipulate asset relationships across different tenant boundaries. This flaw particularly affects the application's ability to maintain proper data isolation between tenants, as demonstrated by the vulnerability's impact on cross-tenant link persistence. The vulnerability is further compounded by the fact that victim asset names are exposed through @Formula fields in GET responses, allowing attackers to discover sensitive information about assets belonging to other tenants without proper authorization. This creates a comprehensive attack vector that combines unauthorized data manipulation with information disclosure capabilities.
The operational impact of this vulnerability extends beyond simple privilege escalation to encompass complete tenant isolation bypass and potential data exposure across multiple organizational boundaries. Attackers can not only create persistent links between alarms and assets from different realms but also gain visibility into asset configurations and names belonging to other tenants, potentially exposing sensitive organizational data. The vulnerability affects the core multi-tenant functionality of OpenRemote, undermining trust in the application's security model and potentially enabling attackers to access confidential information or manipulate critical alarm configurations across tenant boundaries. This represents a significant threat to organizations relying on OpenRemote for enterprise asset management where tenant isolation is crucial for maintaining operational security and data privacy standards.
This vulnerability aligns with CWE-639 (Insecure Direct Object Reference) and maps to attack patterns involving unauthorized access to resources through flawed object reference validation mechanisms. The implementation flaw demonstrates poor security design principles in handling multi-tenant access controls, where the single-point validation approach fails to account for the complexity of multi-realm scenarios. Organizations should prioritize immediate mitigation by upgrading to version 1.27.0 or later, which addresses this vulnerability through proper realm validation that examines all realms rather than just a randomly selected subset from the HashSet collection. The fix ensures comprehensive access control validation by implementing proper iteration over all realms in the request rather than relying on potentially unreliable first-element selection methods. Security teams should also conduct thorough audits of similar patterns throughout the application codebase to identify and remediate other potential insecure direct object reference vulnerabilities that could compromise tenant isolation and data security across multi-tenant environments.