CRITICAL 9.0 NVD
CVE-2026-114661
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and qu
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open persistent bidirectional TCP circuits into an edge gateway's network or tear down operator tunnels.
References
- https://github.com/openremote/core/security/advisories/GHSA-5h8w-vg25-fw38
- https://www.vulncheck.com/advisories/openremote-1.2.0-before-1.31.0-missing-authorization-
This critical severity vulnerability with a CVSS score of 9.0 was published on 2026-10-22 via NVD.
Risk Timeline
CVE Disclosed2026-10-22 · -1 days ago
Remediation Resources
vulnfeed aggregates 18809 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.