---
id: CVE-2026-116185
title: >-
  OpenRemote before 1.31.0 Cross-Realm Information Disclosure via
  getGatewayActiveTunnelInfos
summary: >-
  OpenRemote core before 1.31.0 contains an authorization bypass vulnerability
  that allows authenticated users to read other realms' gateway tunnel
  information via getGatewayActiveTunnelInfos. Attackers can request the gateway
  tunnel endpo…
severity: medium
cvss: 5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: openremote
product: core
affected:
  - core < 1.31.0
published: '2026-10-25'
updated: '2026-10-25'
sourceUpdated: '2026-10-25T13:22:09.474Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116185'
references:
  - url: 'https://github.com/openremote/core/security/advisories/GHSA-p5wh-9wx4-w5f3'
    label: GitHub Security Advisory (GHSA-p5wh-9wx4-w5f3)
  - url: >-
      https://www.vulncheck.com/advisories/openremote-before-1.31.0-cross-realm-information-disclosure-via-getgatewayactivetunnelinfos
    label: >-
      VulnCheck Advisory: OpenRemote before 1.31.0 Cross-Realm Information
      Disclosure via getGatewayActiveTunnelInfos
tags:
  - cve.org
ingestedAt: '2026-10-25T22:08:29.938Z'
---

## Overview

OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own realm and a victim gateway ID to disclose internal target hosts, ports, and routing data.

## Affected

- `core < 1.31.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.