High severity · published Oct 22, 2026
CVE-2026-114661
OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints
New
8.5
CVSS
0.2%
EPSS
No
On KEV
Description
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open persistent bidirectional TCP circuits into an edge gateway's network or tear down operator tunnels.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openremote · openremote
1.2.0 before 1.31.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114661
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114661
github.com
https://github.com/openremote/core/security/advisories/GHSA-5h8w-vg25-fw38
www.vulncheck.com
https://www.vulncheck.com/advisories/openremote-1.2.0-before-1.31.0-missing-authorization-in-gateway-tunnel-endpoints
More from openremote
9.9
CVE-2026-39842
OpenRemote is Vulnerable to Expression Injection
9.8
CVE-2022-31860
An issue was discovered in OpenRemote through 1.0.4 allows attackers to execute arbitrary code via a crafted Groovy rule
9.3
CVE-2026-66013
OpenRemote before 1.26.2 Authentication Bypass via Console Registration
8.8
CVE-2026-62238
OpenRemote < 1.26.0 SQL Injection via Crosstab Export
8.1
CVE-2026-56784
OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint