PatchSiren cyber security CVE debrief
CVE-2026-65009 openremote CVE debrief
CVE-2026-65009 is an information disclosure vulnerability in OpenRemote versions before 1.26.2. The SyslogResource REST endpoint fails to filter operational logs by realm, allowing attackers with the read:rules role to access the GET /api/{realm}/syslog/event endpoint and retrieve operational logs from all tenants, exposing asset IDs, agent connection details, rule names, and protocol errors across the multi-tenant deployment. This vulnerability has a CVSS score of 5.3 and a severity rating of MEDIUM. Users of OpenRemote versions before 1.26.2 should be aware of this information disclosure vulnerability and take steps to mitigate it.
- Vendor
- openremote
- Product
- Unknown
- CVSS
- MEDIUM 5.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-21
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-07-21
- Advisory updated
- 2026-07-22
Who should care
Users of OpenRemote versions before 1.26.2, security teams responsible for vulnerability management, and operators of multi-tenant deployments should be aware of this information disclosure vulnerability and take steps to mitigate it. This includes upgrading to version 1.26.2 or later, and ensuring that access to the SyslogResource REST endpoint is properly restricted.
Technical summary
The vulnerability exists in the SyslogResource REST endpoint of OpenRemote versions before 1.26.2. The endpoint fails to filter operational logs by realm, allowing attackers with the read:rules role to access logs from all tenants. This can result in the exposure of sensitive information, including asset IDs, agent connection details, rule names, and protocol errors. The vulnerability has a CVSS score of 5.3 and a severity rating of MEDIUM. The CVE record indicates that the vulnerability was publicly disclosed on 2026-07-21.
Defensive priority
Medium
Recommended defensive actions
- Upgrade to OpenRemote version 1.26.2 or later
- Restrict access to the SyslogResource REST endpoint
- Monitor for suspicious activity on the SyslogResource REST endpoint
- Review and update access controls for the read:rules role
- Perform a thorough review of the affected system's logs for potential exposure
- Inventory affected assets and prioritize remediation based on criticality
- Track exceptions and retest remediated assets to ensure the vulnerability is properly addressed
Evidence notes
The CVE record was published on 2026-07-21T12:19:01.327Z and was last modified on 2026-07-22T15:17:22.147Z. The NVD entry is currently Received. The information disclosure vulnerability exists in OpenRemote versions before 1.26.2, affecting the SyslogResource REST endpoint. Evidence of this vulnerability's existence is limited to the CVE and NVD records. Defenders should verify the accuracy of this information within the context of their specific environments and review the official CVE record for further details.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T12:19:01.327Z and has not been modified since then. The NVD entry is currently Received.