OpenRemote CVE-2026-114661

Requires a valid but non-administrative authenticated OpenRemote account (CVSS PR:L) and an OpenRemote instance in the vulnerable range 1.2.0 through before 1.31.0 that actually uses the gateway tunneling feature of GatewayServiceResource with at least one edge gateway configured - the POST/DELETE tunnel endpoints must be reachable and operational. Exploitation does not need an admin role, user interaction, or a non-default code path beyond having gateway tunneling in use; the limiting factors are therefore the need for any authenticated account and the presence of a configured edge-gateway tunnel deployment (reflected by the AT:P attack-requirement metric). Instances not using gateway tunnels, or upgraded to 1.31.0+, are not exposed.

Signals align on genuine high priority but with one meaningful gate. The vendor/NVD CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) and score of 9.0 indicate network-reachable, low-complexity exploitation requiring only a low-privileged authenticated account - consistent with the CWE-862 (missing authorization) description, where any authenticated user bypasses the administrative-role requirement on GatewayServiceResource. The high subsequent-system impact metrics (SC:H/SI:H/SA:H) correctly reflect that a tunnel pivots into the edge gateway's network, i.e. a scope change into other systems. The one tempering factor is AT:P (attack requirement present), suggesting exploitation is not entirely unconditional - likely that a gateway/tunnel feature must actually be configured and reachable. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or opportunistic exploitation at this time; the severity is driven by impact and low privilege barrier rather than by demonstrated in-the-wild activity. Net: a real, prioritize-for-patching issue for anyone running OpenRemote gateway tunneling, but the authenticated-account prerequisite and absence of exploitation evidence make it a targeted-insider/post-foothold risk rather than a mass-exploitation internet threat. Note the input 'Authentication Bypass' tag is slightly imprecise - the attacker is already authenticated; this is authorization bypass / privilege escalation, not authentication bypass.

A user holding any ordinary authenticated OpenRemote account (no admin role) sends a crafted POST request to the gateway tunnel endpoint, which fails to enforce the administrative-role check. This opens a persistent bidirectional TCP circuit into the edge gateway's internal network, letting the attacker pivot to otherwise unreachable devices; a DELETE request can conversely tear down legitimate operator tunnels to disrupt operations. No public exploit identified at time of analysis, though the attack is a simple REST call requiring no special tooling.