Low severity · published Oct 25, 2026
CVE-2026-116184
OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket
New
2.1
CVSS
0.2%
EPSS
No
On KEV
Description
OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
core · openremote
before 1.31.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116184
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116184
github.com
https://github.com/openremote/core/security/advisories/GHSA-2j4x-qh6q-q8mm
www.vulncheck.com
https://www.vulncheck.com/advisories/openremote-before-1.31.0-cross-realm-gateway-impersonation-via-websocket
More from core
5.0
CVE-2026-116185
OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos
2.3
CVE-2026-116186
OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId