CVE-2026-116186: OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId

Q: Which deployments are exposed?

OpenRemote openremote-manager deployments before 1.31.0 are affected where inbound events from registered edge gateways are accepted. The issue can cross realm boundaries, so tenant isolation is at risk.

Q: What does an attacker need to exploit this?

The attacker needs control of a registered gateway. They can submit crafted AttributeEvent or DELETE AssetEvent messages using pre-image asset IDs.

Q: What can an attacker do through the bypass?

A compromised or attacker-controlled registered gateway can overwrite attributes of assets in any realm or delete assets in any realm.

Published Oct 25, 2026

Updated

OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image IDs in AttributeEvent or DELETE AssetEvent messages to overwrite attributes on, or delete, assets in any realm, breaking tenant isolation.

Affected Software

1 affected component

OpenRemote openremote-manager<1.31.0

Event History

Oct 25, 2026

CVE Published

via MITRE·01:22 PM

Data Sourced

via MITRE·01:22 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed?

OpenRemote openremote-manager deployments before 1.31.0 are affected where inbound events from registered edge gateways are accepted. The issue can cross realm boundaries, so tenant isolation is at risk.

What does an attacker need to exploit this?

The attacker needs control of a registered gateway. They can submit crafted AttributeEvent or DELETE AssetEvent messages using pre-image asset IDs.

What can an attacker do through the bypass?

A compromised or attacker-controlled registered gateway can overwrite attributes of assets in any realm or delete assets in any realm.

CVE-2026-116186: OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

What can an attacker do through the bypass?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

What can an attacker do through the bypass?