CVE-2026-126769

HIGH 7.5

OpsTree REMS through 1.0.0 Missing Authentication via /api/v1/databases Governance API

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

OpsTree REMS through 1.0.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access Governance API endpoints, including /api/v1/databases. Attackers can send requests without an Authorization header, or with invalid or tampered JWT tokens, to retrieve stored database hosts, usernames, and passwords.

CWE	CWE-306
Vendor	opstree solutions
Product	rems
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for opstree solutions rems

Be the first to know when new high vulnerabilities affecting opstree solutions rems are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

OpsTree Solutions / REMS

0 ≤ 1.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

gist.github.com: https://gist.github.com/neelkotnis/493d542098b328570f821dc152146732 gist.github.com: https://gist.github.com/neelkotnis/3fc4a8587179a8691ed89056ea7df076 opstree.com: https://opstree.com/rems-ai-powered-observability/ vulncheck.com: https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-missing-authentication-via-api-v1-databases-governance-api

Credits

Neel Saurabh Kotnis