CVE-2026-116185: OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos
OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own realm and a victim gateway ID to disclose internal target hosts, ports, and routing data.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated OpenRemote user can exploit it. The attacker needs access to one realm and a gateway ID belonging to another realm.
What information could be exposed?
The gateway tunnel endpoint can disclose another realm's internal target hosts, ports, and routing data.
Are unauthenticated attackers affected?
No. Exploitation requires authentication with a low-privileged account; no user interaction is required.
Which versions need remediation?
OpenRemote Core versions before 1.31.0 are affected. Updating to 1.31.0 or later removes the stated affected version range.