CVE-2026-114661
OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints
CVSS Score
8.5
EPSS Score
0.0%
EPSS Percentile
0th
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open persistent bidirectional TCP circuits into an edge gateway's network or tear down operator tunnels.
| CWE | CWE-862 |
| Vendor | openremote |
| Product | openremote |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for openremote openremote
Be the first to know when new high vulnerabilities affecting openremote openremote are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
openremote / openremote
1.2.0 < 1.31.0
References
Credits
🔍 kocaemre 🔍 kta1kri