Description
OpenRemote versions before 1.26.2 contain an information disclosure vulnerability in the SyslogResource REST endpoint that fails to filter operational logs by realm. Attackers with the read:rules role can access the GET /api/{realm}/syslog/event endpoint to retrieve operational logs from all tenants, exposing asset IDs, agent connection details, rule names, and protocol errors across the multi-tenant deployment.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openremote | openremote | < 1.26.2 | 1.26.2 |
References
- GitHub Security Advisory (GHSA-fv8q-rwj8-2c55) vendor-advisory
- VulnCheck Advisory: OpenRemote before 1.26.2 Information Disclosure via Syslog REST API third-party-advisory