PT-2026-120943

CVE-2026-114661

Published

2026-10-22

Updated

2026-10-22

Description by

CVSS 4.0

9.0

Critical

MetricsAV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions OpenRemote versions 1.2.0 through 1.30.9

Description Missing authorization in GatewayServiceResource allows authenticated users without an administrative role to manage gateway tunnels. By sending POST or DELETE requests to the gateway tunnel endpoint, an attacker can establish persistent bidirectional TCP circuits into an edge gateway network or terminate existing operator tunnels.

Recommendations Update to version 1.31.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Kocaemre

Kta1Kri

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization