PT-2026-123027

CVE-2026-116186

Published

2026-10-25

Updated

2026-10-25

Description by

CVSS 4.0

2.3

Low

MetricsAV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenRemote core (openremote-manager) versions prior to 1.31.0

Description Insufficient realm or gateway-descendant authorization on inbound edge gateway events allows an attacker controlling a registered gateway to break tenant isolation. The system maps event asset IDs using the reversible GatewayConnector.mapAssetId transform. By crafting pre-image IDs within AttributeEvent or DELETE AssetEvent messages, an attacker can overwrite attributes of or delete assets across any realm.

Recommendations Update OpenRemote core (openremote-manager) to version 1.31.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Hongshengy

Pig-Tail

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key