Skip to content
CVE-2026-114661 in OpenRemote Allows Unauthorized Gateway Access

CVE-2026-114661 in OpenRemote Allows Unauthorized Gateway Access

First seen 22 Oct 2026, 23:41 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 23, 2026 at 01:12 UTC
  • •CVE-2026-114661 allows unauthorized access to gateway tunnels in OpenRemote.
  • •The vulnerability affects versions 1.2.0 to 1.30.0, with a CVSS score of 9.0.
  • •Immediate patching and monitoring are recommended to mitigate risks.

OpenRemote version 1.2.0 before 1.31.0 has a missing authorization vulnerability (CVE-2026-114661) in GatewayServiceResource, allowing authenticated users to manipulate gateway tunnels without administrative privileges. Attackers can exploit this flaw by sending POST or DELETE requests to the gateway tunnel endpoint, potentially gaining access to sensitive internal networks. The risk is particularly high for deployments accessible via the internet or partner networks, especially those connected to sensitive building, industrial, or IoT systems. The vulnerability has a CVSS score of 9.0, indicating severity. No proof-of-concept or has been confirmed yet. Organizations are advised to apply the vendor's patch and restrict access to management interfaces. Monitoring for unusual tunnel activity is also recommended.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-22
CVE-2026-114661 published
OpenRemote disclosed a critical missing authorization vulnerability affecting versions prior to 1.31.0.
Redpacketsecurity
2026-10-22
Vulnerability advisory released
Vulncheck published details on the missing authorization issue in OpenRemote, emphasizing its critical nature.
www.vulncheck.com

More articles in this cluster (3)

Following this threat?

Track CVE-2026-114661 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (3)

1 / 3

Common questions

Which versions of OpenRemote are affected?
OpenRemote versions 1.2.0 to 1.30.0 are affected by CVE-2026-114661.
What should I do to protect my systems?
Apply the vendor's patch to upgrade to version 1.31.0 or later and restrict access to gateway management interfaces.
Is there any active exploitation of this vulnerability?
No active exploitation has been confirmed, but the vulnerability is classified as critical.