CVE-2026-124436: OpenRemote before 1.32.2 Improper Authorization Allows Realm Admins to Modify Global Resources
Published Nov 8, 2026
·Updated
OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resources by calling admin endpoints lacking super administrator checks. Attackers can change the global keycloakUrl via /configuration/manager to redirect other realms' console authentication for credential phishing, inject CSS, replace map tiles, and delete logs.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenRemoteto a version that resolves this vulnerability.Fixed in 1.32.2
Event History
Nov 8, 2026
CVE Published
via MITRE·01:15 PM
Data Sourced
via MITRE·01:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:18 PM
DescriptionSeverityWeakness