CVE-2026-116186

The OpenRemote core (openremote-manager) before version 1.31.0 is vulnerable to a gateway authorization bypass . The root cause is that the system fails to perform realm or gateway-descendant authorization on inbound edge gateway events, relying instead on a reversible GatewayConnector.mapAssetId...

EUVD-2026-109470

OpenRemote core openremote-manager before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image I...

EUVD-2026-109469

OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own realm and a victim gateway ID to disclose...