CVE-2026-114661 openremote CVE debrief

Who should care

OpenRemote users and administrators should assess exposure and verify patching to prevent unauthorized access to gateway tunnels. This includes reviewing user role configurations, verifying patching to ensure OpenRemote version 1.31.0 or later is deployed, and monitoring for unauthorized tunnel management activity. Security teams should prioritize verifying patching and restricting gateway tunnel management to administrative roles.

Why it matters

CVE-2026-114661 is a critical vulnerability in OpenRemote that allows authenticated users to manage gateway tunnels without administrative privileges. This could enable unauthorized access or disruption of operator tunnels, making it a high priority for OpenRemote users to assess exposure and verify patching.

• Potential unauthorized access to edge gateway networks.
• Possible disruption of operator tunnels.
• Need for verification of user role configurations and patching.
• Potential for exploitation by authenticated users.

Technical summary

The vulnerability exists in the GatewayServiceResource of OpenRemote versions 1.2.0 before 1.31.0, allowing authenticated users to start, stop, and query gateway tunnels without administrative privileges. This could enable attackers to create persistent bidirectional TCP circuits into an edge gateway's network or disrupt operator tunnels. The vulnerability allows authenticated users to manage gateway tunnels without administrative privileges, making it a high priority for OpenRemote users to assess exposure and verify patching.

Defensive priority

High priority for OpenRemote users to assess exposure and verify patching, focusing on restricting tunnel management to administrative roles.

Recommended defensive actions

• Assess exposure by verifying OpenRemote version and user role configurations.
• Restrict gateway tunnel management to administrative roles.
• Verify patching to ensure OpenRemote version 1.31.0 or later is deployed.
• Monitor for unauthorized tunnel management activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but specific version details and remediation steps require verification from official sources. The vulnerability allows authenticated users to manage gateway tunnels without administrative privileges, potentially enabling unauthorized access or disruption of operator tunnels. OpenRemote users should verify patching to ensure OpenRemote version 1.31.0 or later is deployed and monitor for unauthorized tunnel management activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.