CVE-2026-65009

MEDIUM 4.3

OpenRemote before 1.26.2 Information Disclosure via Syslog REST API

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

OpenRemote versions before 1.26.2 contain an information disclosure vulnerability in the SyslogResource REST endpoint that fails to filter operational logs by realm. Attackers with the read:rules role can access the GET /api/{realm}/syslog/event endpoint to retrieve operational logs from all tenants, exposing asset IDs, agent connection details, rule names, and protocol errors across the multi-tenant deployment.

CWE	CWE-200
Vendor	openremote
Product	openremote
Published	Jul 21, 2026

Stay Ahead of the Next One

Get instant alerts for openremote openremote

Be the first to know when new medium vulnerabilities affecting openremote openremote are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

openremote / openremote

0 < 1.26.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openremote/openremote/security/advisories/GHSA-fv8q-rwj8-2c55 vulncheck.com: https://www.vulncheck.com/advisories/openremote-before-information-disclosure-via-syslog-rest-api

Credits

🔍 manus-use