CVE-2026-114661

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-114661
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114661.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-114661
Aliases
  • GHSA-5h8w-vg25-fw38
Published
2026-10-22T01:43:45Z
Modified
2026-10-22T10:46:12Z
Severity
  • 9.0 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H CVSS Calculator
Summary
OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints
Details

OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open persistent bidirectional TCP circuits into an edge gateway's network or tear down operator tunnels.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114661.json"
}
References

Affected packages

Git / github.com/openremote/core

Affected ranges

Type
GIT
Repo
https://github.com/openremote/core
Events
Introduced
d358e7dd874f28433b844a035a241ed9d29a98a6
Fixed
9c635f76d93365fc09d004fdb5a447852fa29ed7
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "1.2.0"
                },
                {
                    "fixed":  "1.31.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

1.*
1.10.0
1.11.0
1.11.1
1.11.2
1.11.3
1.12.0
1.12.1
1.12.2
1.12.3
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.16.0
1.16.1
1.17.0
1.17.1
1.17.2
1.17.3
1.18.0
1.19.0
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.20.0
1.20.1
1.20.2
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.24.1
1.24.2
1.25.0
1.26.0
1.26.1
1.26.2
1.27.0
1.27.1
1.28.0
1.28.1
1.29.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.30.0
1.30.1
1.4.0
1.5.0
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.7.0
1.8.0
1.8.1
1.9.0
Other
archive/console_loader

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114661.json"