CVE-2026-39842
- Source
- https://cve.org/CVERecord?id=CVE-2026-39842
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39842.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-39842
- Aliases
- Published
- 2026-04-14T23:21:22.242Z
- Modified
- 2026-08-12T16:23:59.303056Z
- Severity
-
- 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- OpenRemote is Vulnerable to Expression Injection
- Details
-
OpenRemote is an open-source IoT platform. Versions 1.21.0 and below contain two interrelated expression injection vulnerabilities in the rules engine that allow arbitrary code execution on the server. The JavaScript rules engine executes user-supplied scripts via Nashorn's ScriptEngine.eval() without sandboxing, class filtering, or access restrictions, and the authorization check in RulesResourceImpl only restricts Groovy rules to superusers while leaving JavaScript rules unrestricted for any user with the write:rules role. Additionally, the Groovy rules engine has a GroovyDenyAllFilter security filter that is defined but never registered, as the registration code is commented out, rendering the SandboxTransformer ineffective for superuser-created Groovy rules. A non-superuser attacker with the write:rules role can create JavaScript rulesets that execute with full JVM access, enabling remote code execution as root, arbitrary file read, environment variable theft including database credentials, and complete multi-tenant isolation bypass to access data across all realms. This issue has been fixed in version 1.22.0.
- Database specific
{ "cwe_ids": [ "CWE-917", "CWE-94" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39842.json", "cna_assigner": "GitHub_M" }- References
Affected packages
Git / github.com/openremote/openremote
Affected ranges
- Type
- GIT
- Repo
- https://github.com/openremote/openremote
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0" }, { "fixed": "1.22.0" } ], "source": [ "AFFECTED_FIELD", "CPE_RANGE", "REFERENCES" ] }
Affected versions
1.*
1.10.0
1.11.0
1.11.1
1.11.2
1.11.3
1.12.0
1.12.1
1.12.2
1.12.3
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.16.0
1.16.1
1.17.0
1.17.1
1.17.2
1.17.3
1.18.0
1.19.0
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.20.0
1.20.1
1.20.2
1.21.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.5.0
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.7.0
1.8.0
1.8.1
1.9.0
Other
archive/console_loader
Database specific
vanir_signatures_modified
"2026-08-12T16:23:59Z"
vanir_signatures
[
{
"id": "CVE-2026-39842-37d50ee0",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 845.0,
"function_hash": "262344609711769585219135329869613188667"
},
"source": "https://github.com/openremote/openremote/commit/01d9cc2f6b65e1c8847bcb2922bdd897dd0a2f1a",
"target": {
"function": "createAssetRuleset",
"file": "manager/src/main/java/org/openremote/manager/rules/RulesResourceImpl.java"
}
},
{
"id": "CVE-2026-39842-3edbc1da",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1120.0,
"function_hash": "8706605273139416489710717079014470320"
},
"source": "https://github.com/openremote/openremote/commit/01d9cc2f6b65e1c8847bcb2922bdd897dd0a2f1a",
"target": {
"function": "updateAssetRuleset",
"file": "manager/src/main/java/org/openremote/manager/rules/RulesResourceImpl.java"
}
},
{
"id": "CVE-2026-39842-509088db",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 738.0,
"function_hash": "313343722639178910085870984596500631147"
},
"source": "https://github.com/openremote/openremote/commit/01d9cc2f6b65e1c8847bcb2922bdd897dd0a2f1a",
"target": {
"function": "createRealmRuleset",
"file": "manager/src/main/java/org/openremote/manager/rules/RulesResourceImpl.java"
}
},
{
"id": "CVE-2026-39842-63e82d11",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1042.0,
"function_hash": "239216556527686170801138448147896421414"
},
"source": "https://github.com/openremote/openremote/commit/01d9cc2f6b65e1c8847bcb2922bdd897dd0a2f1a",
"target": {
"function": "updateRealmRuleset",
"file": "manager/src/main/java/org/openremote/manager/rules/RulesResourceImpl.java"
}
},
{
"id": "CVE-2026-39842-6726753b",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 224.0,
"function_hash": "23750766590422561149341149817927868774"
},
"source": "https://github.com/openremote/openremote/commit/01d9cc2f6b65e1c8847bcb2922bdd897dd0a2f1a",
"target": {
"function": "createGlobalRuleset",
"file": "manager/src/main/java/org/openremote/manager/rules/RulesResourceImpl.java"
}
},
{
"id": "CVE-2026-39842-8bd86ace",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"112177918831219321789302284231646925924",
"281016791494566277055451453835392322351",
"234527408294299625685965633984573904830",
"150710123105791639586632071340029904677",
"200063947854724540074844026963290864192",
"231817165535170052902813136054828579437",
"235173485976027128267946884327159583388",
"337322016445520090871580920620755738814",
"51624397522206463083153065240716992003",
"43198958533983064107034712154402640180",
"280180513320814117172003745808398288686",
"94232593780625956445425058410441557537",
"28867856239357858183764256852698406868",
"169256043002585225732069110444502945582",
"139450067191708954668090879286328397964",
"252220856526893180968698909048904523350",
"251477720559099737518955913553683118032",
"41151026617945397478562086402072390221",
"64361593445085278552785041780655906916",
"26992697100225001529632553185442153658",
"85594102238729924552776620441480065139",
"183594254886767809243406255531604195224",
"224305828430982708018571672826079009010",
"98896770493275538418293024305801992973",
"287612939809819808353431626194085410710",
"211208660778872008416238637852019169807",
"265241446529439970507664511176747632027",
"187685193456521700313520400887318688426",
"61949475220696697323519046146774456983",
"131020772823381640243946383974309601707",
"11947260563646349732442621267070023821",
"35366639649072962228766886302008624553",
"205204242589338735351875457547631886573",
"186788520392797137255169446135960994584",
"206944794018509352691082084271884526160",
"123008567835099082238139535700465162281",
"171556408870698126300319792204858222476",
"207657195822116753123919493000507836977",
"260939235861937780482067559565820809286",
"304706852521201061953798965564861229102",
"17758992882948861437311839470770212686",
"177195478387223754210897916555738953053",
"114655371386780120218654163948166693505",
"100621888865719254400633513288981992178",
"143423705233959370071949180814197697516",
"306138479810186136863364359259726578240",
"261408575225256879194611652890007466232",
"299658873351745869662924006320080897226",
"204126127862269920109082435660749242914",
"54002510509137532010167292322913694191",
"328650404464818397246206744093382207446",
"88344280869640133267136098617414019531",
"97571362714039652177316355187240355497",
"161411763495113688268860840139367682726",
"258900937447131683129953277596787064213",
"245182827686026477463023314336377775317",
"85142576242526503933786737793677124537",
"236467789225748061769717498281427454625",
"274286773438040181714181145572846460558",
"270483383047897253813839411803386426299",
"84875847172557275557413750944530938909",
"66197398498126513371580950865282362290",
"121545549385577211026582012276719756734",
"291806483705322113067447544241165321121",
"271419102224634406123739657470481889128",
"258294648820505720915643533471915198621",
"57913482630293055247843830801643052884",
"177451187483388990420056896715446098679",
"125957865427168381506314374907799990471",
"237786916098577377547506914374859754568",
"311439016338914154566701670176681604313",
"155362788877685668400670509444092661330",
"53366356929108239489413424997100846997",
"65874381006390969751822857052668920435",
"284966103695415453434801786850952463712",
"154691394643270385953504413749555863450",
"140299306511013655736022106057246159513",
"141078585313240755696353768958134406869",
"297397391136999809275838040246142258164",
"61076505722115561438623082179342768626",
"183277482881292955756829641287368107731",
"332745819605960512830897317537609690715",
"248871381418161129773678321788207855592",
"111909580583550666515129590985647964534",
"259426649198093629902587589200885047463",
"62381167751205612797430815817639872849",
"227721457931792907764660251870427873170",
"212588408053927830596876115499348969701",
"50958172794040486660380230127812494966",
"70810886678301505787465035506703369742",
"132045808438171730817952078205995870051",
"131476212431099935993443825440810934612",
"321668903206886327023904363037390568460",
"268713166517111344940180474289780232909",
"24646273672984608312179702194312137300",
"142607849261546125502905596920105571469",
"256565001709244697310156263536489152764",
"7459714439687820607069342072064106183",
"308997130535485444288285717357538941118",
"105615059841502486486024027701209971124",
"216668790405931191149900938799418182151",
"289055017581204730413229648807443845589",
"229085819657994259424410848480846420671",
"8135872098152583677584617115888369191",
"47564345775939600803349008163984559901",
"271965613321513406536347651275409934622",
"87749176698411116380500880887244283673",
"185585915848765841438832636104688144",
"237078397548637749132476236197847058352",
"100950431841759841155201654293641938719",
"104040620987424471909076294167552217287",
"42295604171558620778286606655016750089",
"148449522587184979339152322018653350429",
"146119753620399733297157749586971196922",
"221639201178402596154700649658811499549",
"335662227921298198810888737974728615277",
"220779791296060847619771503170553352668",
"279029363541655763150484096322166437270",
"53296140370134297658345253517038752476",
"175795233875733511948768615994476850149",
"184769477897914954413364766198862157778",
"222320727219299053933484509452127198331",
"214075026288239849307161384999143092894",
"198267632902915803709100947835135181195",
"39143615960824914349223664586458162495",
"71999737552737318531891204895267096595",
"336623950052441005206096056923237709025",
"235409075945205606490417773587270074991",
"91133196277642883441889676870362250621",
"335786931192972751699223969730155935951",
"199078223550782745250857137045637046628",
"215736141312864228258229395753968991039",
"262847712781325743016367370779180814383",
"53311562850490860075351037760532816518",
"223794098941927126015761623233463704125",
"75415360871939178263697850838488384878",
"2419179758707896021147423333302747984",
"195943660094307605808023564323051466149",
"160766870716035989369134368411228263482",
"130596627496827395043183905856366122274",
"143242994109244695268326404337282195080",
"60498338279330268111857907009550108742",
"282481845130950117182825395220618626458",
"201301613833145950066404319110308192925",
"12206355343291561201347055413551215537",
"208939188882308207428203317392569323220",
"148590635730546638216041557549999523851",
"196511641864717736276772784850230864193",
"226256395860715899107930153660432548294",
"258256479446802877685393770520894731685",
"14715293635842366239090581385860834980",
"230209881071809857475378186244753158489",
"316690669290082975896842410849135067181",
"193945808628594412366544287625663367568",
"80496749102163105102572109980890103606",
"253420946508311583007643808657070692011",
"250067154963237393265757049998409392588",
"262879408649966382084216231729199520223",
"1905296531889858012359589845363701856",
"217412351361473362387067259354594182603",
"284086336432053641203796754142889167106",
"9317071801753129416553807381033427993",
"77175588494147154310525843667730591430"
]
},
"source": "https://github.com/openremote/openremote/commit/01d9cc2f6b65e1c8847bcb2922bdd897dd0a2f1a",
"target": {
"file": "manager/src/main/java/org/openremote/manager/rules/RulesetDeployment.java"
}
},
{
"id": "CVE-2026-39842-a9757117",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 673.0,
"function_hash": "187661022738469871598207265681082711096"
},
"source": "https://github.com/openremote/openremote/commit/01d9cc2f6b65e1c8847bcb2922bdd897dd0a2f1a",
"target": {
"function": "compile",
"file": "manager/src/main/java/org/openremote/manager/rules/RulesetDeployment.java"
}
},
{
"id": "CVE-2026-39842-d0a32b67",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 327.0,
"function_hash": "300247437249595470476319436472399558951"
},
"source": "https://github.com/openremote/openremote/commit/01d9cc2f6b65e1c8847bcb2922bdd897dd0a2f1a",
"target": {
"function": "updateGlobalRuleset",
"file": "manager/src/main/java/org/openremote/manager/rules/RulesResourceImpl.java"
}
},
{
"id": "CVE-2026-39842-ea0684a3",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 3249.0,
"function_hash": "2080715412182694399303458494523305639"
},
"source": "https://github.com/openremote/openremote/commit/01d9cc2f6b65e1c8847bcb2922bdd897dd0a2f1a",
"target": {
"function": "compileRulesJavascript",
"file": "manager/src/main/java/org/openremote/manager/rules/RulesetDeployment.java"
}
},
{
"id": "CVE-2026-39842-fad6dd53",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"37958179051547056858287815818074482265",
"159050053260340748696707992800986485386",
"128724947228055690515959518170165012443",
"107396264951875272351435592664968478974",
"16457912837449657953931467138898513433",
"74271296167072545644843568656288976390",
"94625434813896695115204947231385316495",
"33610438320407802861092608131139789230",
"320009213869842826415994469184746231435",
"206903225121959046185715030483708396944",
"288703573091063269152258348223996455722",
"111816029480637543700605363134019832216",
"58033314382984668077634447562584584059",
"233266346590369204167497235739894839525",
"89864015341200578567443920843056187280",
"256361074168301498799654483511784181442",
"83912281639285818971409498355923241971",
"340102317641541741971898514225774272504",
"142289329687401390960556078455108359166",
"84565309990862581070178937620269014450",
"103259328080334252180221455197695723512",
"134651681777775846991228162492041447023",
"182959010706731871031572872758364986580",
"86535444414622157003190278245797510092",
"73890621102773919521510340938813052275",
"329260615696629227153403503731897377575",
"182959010706731871031572872758364986580",
"140325795727374179258384831670895794561",
"223673099651945052022225583990877392179",
"52339075279001488567980257908346045638",
"182959010706731871031572872758364986580"
]
},
"source": "https://github.com/openremote/openremote/commit/01d9cc2f6b65e1c8847bcb2922bdd897dd0a2f1a",
"target": {
"file": "manager/src/main/java/org/openremote/manager/rules/RulesResourceImpl.java"
}
},
{
"id": "CVE-2026-39842-fd639e7c",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 2081.0,
"function_hash": "67317061036767981956705330212159853702"
},
"source": "https://github.com/openremote/openremote/commit/01d9cc2f6b65e1c8847bcb2922bdd897dd0a2f1a",
"target": {
"function": "compileRulesJavascript",
"file": "manager/src/main/java/org/openremote/manager/rules/RulesetDeployment.java"
}
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39842.json"