openremote has 17 CVEs on record. Cadence is steady at roughly 10 per quarter. The busiest recent month was October 2026 with 6. The median CVSS is 7.7 (high), with 3 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-639 (9). Most affected products: openremote (7), io.openremote:openremote-manager (6), core (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.7
- Publish → KEV
- —
- Last 90 days
- 10 prev 7
Products
- openremote 7
- io.openremote:openremote-manager 6
- core 3
- io.openremote:openremote-agent 1
Worst active — by depth score
CVE-2026-62238High· 8.8OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL60CVE-2026-114661High· 8.5OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints59CVE-2026-56784High· 8.1OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary…57CVE-2026-54641High· 7.7OpenRemote is an open-source internet-of-things platform54CVE-2026-57168Critical· 9.6Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER53
openremote vulnerabilities
CVEs affecting openremote, newest first. Open any entry for full detail, references, and exploit status.
17 CVEsRSS
CVE-2026-116185Medium· 5.0OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos
OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpo…
CVE-2026-116186Low· 2.3OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId
OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An a…
CVE-2026-116184Low· 2.1OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket
OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one …
CVE-2026-114661High· 8.5PoCOpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST o…
CVE-2026-54641High· 7.7PoCOpenRemote is an open-source internet-of-things platform
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with t…
CVE-2026-54640High· 7.6OpenRemote is an open-source internet-of-things platform
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's upl…
CVE-2026-57168Critical· 9.6Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-56120. Reason: This candidate is a duplicate of CVE-2026-56120. Notes: All CVE users should reference CVE-2026-56120 instead of this candidate.
CVE-2026-49439Medium· 4.3OpenRemote is an open-source internet-of-things platform
OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only `read:assets` privileges to write predicted datapoints. Version 1.24.1 fixes the issue.
CVE-2026-81679High· 7.7OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies
OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attac…
CVE-2026-67310Medium· 5.4OpenRemote (org.openremote:openremote) versions <= 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl
OpenRemote (org.openremote:openremote) versions <= 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via rea…
CVE-2026-65009Medium· 4.3PoCOpenRemote versions before 1.26.2 contain an information disclosure vulnerability in the SyslogResource REST endpoint that fails to filter operational logs by realm
OpenRemote versions before 1.26.2 contain an information disclosure vulnerability in the SyslogResource REST endpoint that fails to filter operational logs by realm. Attackers with the read:rules role can access the GET /api/{realm}/sysl…
CVE-2026-62238High· 8.8PoCOpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL
OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with …
GHSA-cgfv-jrfp-2r7vHighOpenRemote has Authenticated SQL Injection via Datapoint Crosstab Export
OpenRemote has Authenticated SQL Injection via Datapoint Crosstab Export
CVE-2026-56784High· 8.1PoCOpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary…
OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary…
GHSA-vjr9-f93j-mjr7High· 8.1Duplicate Advisory: OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
Duplicate Advisory: OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
CVE-2026-56120Critical· 9.6OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
GHSA-h3m5-97jq-qjrfCritical· 9.6OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)