Vulnerability · Published Oct 25, 2026 · Assigned by VulnCheck

CVE-2026-116184OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket

Low 2.1

In plain English

A low-severity authorization bypass via user-controlled key in core from openremote. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 4.0)2.1Low

Exploit odds (30 days)0.2%top 84.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network.

Affected products (as reported)

Vendor	Product	Versions
openremote	core	0 – before 1.31.0

Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

GitHub Security Advisory (GHSA-2j4x-qh6q-q8mm) vendor-advisory
VulnCheck Advisory: OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket third-party-advisory