CVE-2026-65009

Name of the Vulnerable Software and Affected Versions OpenRemote versions prior to 1.26.2

Description An information disclosure issue exists in the SyslogResource REST endpoint due to a failure to filter operational logs by realm. Users with the read:rules role can access the 'GET /api/{realm}/syslog/event' endpoint to retrieve operational logs from all tenants in a multi-tenant deployment. This exposure includes asset IDs, agent connection details, rule names, and protocol errors.

Recommendations Update to version 1.26.2 or later. Restrict access to the 'GET /api/{realm}/syslog/event' endpoint for users with the read:rules role until the update is applied.