CVE-2026-126769: OpsTree REMS through 1.0.0 Missing Authentication via /api/v1/databases Governance API
OpsTree REMS through 1.0.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access Governance API endpoints, including /api/v1/databases. Attackers can send requests without an Authorization header, or with invalid or tampered JWT tokens, to retrieve stored database hosts, usernames, and passwords.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of OpsTree REMS through version 1.0.0 are exposed if their Governance API endpoints are reachable by an attacker over the network. No authenticated account or valid JWT token is required.
What can an unauthenticated attacker obtain?
An attacker can access Governance API endpoints including /api/v1/databases and retrieve stored database hostnames, usernames, and passwords.
Do invalid or altered JWTs prevent exploitation?
No. Requests can be made with no Authorization header, or with invalid or tampered JWT tokens.