PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-65009 openremote CVE debrief

CVE-2026-65009 is an information disclosure vulnerability in OpenRemote versions before 1.26.2. The SyslogResource REST endpoint fails to filter operational logs by realm, allowing attackers with the read:rules role to access the GET /api/{realm}/syslog/event endpoint and retrieve operational logs from all tenants, exposing asset IDs, agent connection details, rule names, and protocol errors across the multi-tenant deployment. This vulnerability has a CVSS score of 5.3 and a severity rating of MEDIUM. Users of OpenRemote versions before 1.26.2 should be aware of this information disclosure vulnerability and take steps to mitigate it.

Vendor
openremote
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-22
Advisory published
2026-07-21
Advisory updated
2026-07-22

Who should care

Users of OpenRemote versions before 1.26.2, security teams responsible for vulnerability management, and operators of multi-tenant deployments should be aware of this information disclosure vulnerability and take steps to mitigate it. This includes upgrading to version 1.26.2 or later, and ensuring that access to the SyslogResource REST endpoint is properly restricted.

Technical summary

The vulnerability exists in the SyslogResource REST endpoint of OpenRemote versions before 1.26.2. The endpoint fails to filter operational logs by realm, allowing attackers with the read:rules role to access logs from all tenants. This can result in the exposure of sensitive information, including asset IDs, agent connection details, rule names, and protocol errors. The vulnerability has a CVSS score of 5.3 and a severity rating of MEDIUM. The CVE record indicates that the vulnerability was publicly disclosed on 2026-07-21.

Defensive priority

Medium

Recommended defensive actions

  • Upgrade to OpenRemote version 1.26.2 or later
  • Restrict access to the SyslogResource REST endpoint
  • Monitor for suspicious activity on the SyslogResource REST endpoint
  • Review and update access controls for the read:rules role
  • Perform a thorough review of the affected system's logs for potential exposure
  • Inventory affected assets and prioritize remediation based on criticality
  • Track exceptions and retest remediated assets to ensure the vulnerability is properly addressed

Evidence notes

The CVE record was published on 2026-07-21T12:19:01.327Z and was last modified on 2026-07-22T15:17:22.147Z. The NVD entry is currently Received. The information disclosure vulnerability exists in OpenRemote versions before 1.26.2, affecting the SyslogResource REST endpoint. Evidence of this vulnerability's existence is limited to the CVE and NVD records. Defenders should verify the accuracy of this information within the context of their specific environments and review the official CVE record for further details.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-65009 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-65009

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-65009 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-65009

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.