CVE-2026-116185Medium· 5.0▾ SunlitOpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpo…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own realm and a victim gateway ID to disclose internal target hosts, ports, and routing data.
core < 1.31.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116186Low· 2.3OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId
CVE-2026-116184Low· 2.1OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket
CVE-2026-53582High· 7.1OPNsense is a FreeBSD based firewall and routing platform
CVE-2026-58391Medium· 5.4OPNsense is a FreeBSD based firewall and routing platform
CVE-2026-58393Medium· 5.9OPNsense is a FreeBSD based firewall and routing platform
CVE-2026-58395Medium· 4.3OPNsense is a FreeBSD based firewall and routing platform