Medium severity · published Oct 25, 2026
CVE-2026-116185
OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos
New
5.0
CVSS
0.2%
EPSS
No
On KEV
Description
OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own realm and a victim gateway ID to disclose internal target hosts, ports, and routing data.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
core · openremote
before 1.31.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116185
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116185
github.com
https://github.com/openremote/core/security/advisories/GHSA-p5wh-9wx4-w5f3
www.vulncheck.com
https://www.vulncheck.com/advisories/openremote-before-1.31.0-cross-realm-information-disclosure-via-getgatewayactivetunnelinfos
More from core
2.3
CVE-2026-116186
OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId
2.1
CVE-2026-116184
OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket