CVE-2026-114661: OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints

Q: Who can exploit this issue?

Any authenticated OpenRemote user can exploit the affected gateway tunnel endpoints; administrative privileges are not required. Exploitation is network-accessible but requires a valid user account.

Q: What could an attacker do through the vulnerable endpoints?

An attacker can start, stop, and query gateway tunnels. They can use POST or DELETE requests to open persistent bidirectional TCP circuits into an edge gateway network or tear down tunnels used by operators.

Q: Which versions are affected?

OpenRemote versions from 1.2.0 before 1.31.0 are affected. Version 1.31.0 is not included in the affected range.

Published Oct 22, 2026

Updated

OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open persistent bidirectional TCP circuits into an edge gateway's network or tear down operator tunnels.

Affected Software

1 affected component

OpenRemote OpenRemote>=1.2.0<1.31.0

Event History

Oct 22, 2026

CVE Published

via MITRE·01:43 AM

Data Sourced

via MITRE·01:43 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated OpenRemote user can exploit the affected gateway tunnel endpoints; administrative privileges are not required. Exploitation is network-accessible but requires a valid user account.

What could an attacker do through the vulnerable endpoints?

An attacker can start, stop, and query gateway tunnels. They can use POST or DELETE requests to open persistent bidirectional TCP circuits into an edge gateway network or tear down tunnels used by operators.

Which versions are affected?