CVE-2026-116186Low· 2.3▾ SunlitOpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An a…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 12.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image IDs in AttributeEvent or DELETE AssetEvent messages to overwrite attributes on, or delete, assets in any realm, breaking tenant isolation.
core < 1.31.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116185Medium· 5.0OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos
CVE-2026-116184Low· 2.1OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket
CVE-2026-53582High· 7.1OPNsense is a FreeBSD based firewall and routing platform
CVE-2026-58391Medium· 5.4OPNsense is a FreeBSD based firewall and routing platform
CVE-2026-58393Medium· 5.9OPNsense is a FreeBSD based firewall and routing platform
CVE-2026-58395Medium· 4.3OPNsense is a FreeBSD based firewall and routing platform