Skip to content
OpenAdvisories

Product · openremote

core

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 2.3
    CVE-2026-116186

    OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId

    OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a …

    openremote core
  • Low 2.1
    CVE-2026-116184

    OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket

    OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a ser…

    openremote core