CVE-2026-116184: OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket

Q: Who can exploit this issue?

An attacker needs WRITE:ADMIN permission in any OpenRemote realm. They can then target a gateway ID belonging to a different realm.

Q: What is the potential impact on a targeted gateway?

The attacker can create a service user named after the target gateway ID, overwrite that gateway's descendant assets, and open SSH tunnels into its local network.

Q: How can I determine whether my deployment is vulnerable?

Deployments running OpenRemote before 1.31.0 are affected. Review whether users have WRITE:ADMIN access in realms and whether gateways exist in other realms that could be targeted by ID.

Published Oct 25, 2026

Updated

OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network.

Affected Software

1 affected component

OpenRemote OpenRemote<1.31.0

Event History

Oct 25, 2026

CVE Published

via MITRE·01:22 PM

Data Sourced

via MITRE·01:22 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs WRITE:ADMIN permission in any OpenRemote realm. They can then target a gateway ID belonging to a different realm.

What is the potential impact on a targeted gateway?

The attacker can create a service user named after the target gateway ID, overwrite that gateway's descendant assets, and open SSH tunnels into its local network.

How can I determine whether my deployment is vulnerable?

Deployments running OpenRemote before 1.31.0 are affected. Review whether users have WRITE:ADMIN access in realms and whether gateways exist in other realms that could be targeted by ID.

CVE-2026-116184: OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the potential impact on a targeted gateway?

How can I determine whether my deployment is vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the potential impact on a targeted gateway?

How can I determine whether my deployment is vulnerable?