CVE Alert: CVE-2026-114661 – openremote

OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open persistent bidirectional TCP circuits into an edge gateway’s network or tear down operator tunnels.

**Risk verdict:** High risk for reachable deployments because a low-privilege account may gain a path into connected networks; exploitation status cannot be confirmed because KEV, SSVC, PoC and EPSS data were not supplied.

**Why this matters:** Misuse of tunnel controls could expose internal services, enable unauthorised changes, or disrupt operational connectivity. The principal concern is a foothold through the application becoming a route to systems behind an edge gateway, not merely impact to the application itself.

**Most likely attack path:** An attacker needs network access and a valid account with limited privileges; no further user action is indicated. Attack-complexity assessments differ across the supplied scoring metrics, and an attack requirement is noted, so confirm what gateway or tunnel state must be present. A successful tunnel may cross a trust boundary and support lateral movement, although it does not by itself guarantee access to every connected system.

**Who is most exposed:** Prioritise internet- or partner-accessible deployments and environments where gateways connect to sensitive building, industrial, or IoT networks. Shared accounts or broad user access increase exposure.

Alert on tunnel start, stop, or query actions by non-administrative accounts.

Review gateway logs for unexpected bidirectional connections or unfamiliar destinations.

Correlate tunnel activity with unusual account logins and downstream service access.

Mitigation and prioritisation

Apply the vendor-fixed release promptly; validate gateway operations after change.

Restrict access to the management interface and tunnel endpoints to trusted networks.

Temporarily disable tunnel functions or limit them to administrators if patching is delayed.

Review active tunnels, user privileges, and gateway-side network exposure.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.