CVE-2026-81679: OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API
OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a zero-parameter GET request to the notification endpoint to retrieve sensitive notification metadata and message content from all realms.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenRemoteto a version that resolves this vulnerability.Fixed in 1.28.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs read:admin credentials in any OpenRemote realm. No user interaction is required, and the vulnerable request can be made remotely through the Notification REST API.
What information can be exposed?
A per-realm tenant administrator can retrieve sent notifications from all tenants, including notification metadata and message bodies. The disclosed message content may contain sensitive information.
Are installations on version 1.28.0 affected?
The issue affects OpenRemote versions before 1.28.0. Version 1.28.0 is not identified as affected by the provided advisory information.
How can I determine whether exploitation may have occurred?
Review Notification REST API access logs for zero-parameter GET requests made by accounts with read:admin credentials, particularly where the response returned notification data outside the requester’s realm.