Is there a patch available for CVE-2026-65009?

Yes, a patch is available for CVE-2026-65009. Update the affected software to the latest version immediately.

OpenRemote CVE-2026-65009

Q: What is the CVSS score of CVE-2026-65009?

CVE-2026-65009 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-46184 MEDIUM

Information Exposure (CWE-200)

2026-07-21 VulnCheck

GHSA-fvrm-x822-jhc4

Information Disclosure Openremote

5.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.0 MEDIUM

AV:N for REST API access, PR:L for required read:rules role, S:C because the breach crosses tenant realm boundaries into a separate security domain.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 21, 2026 - 13:17 EUVD

Analysis Generated

Jul 21, 2026 - 12:32 vuln.today

DescriptionCVE.org

OpenRemote versions before 1.26.2 contain an information disclosure vulnerability in the SyslogResource REST endpoint that fails to filter operational logs by realm. Attackers with the read:rules role can access the GET /api/{realm}/syslog/event endpoint to retrieve operational logs from all tenants, exposing asset IDs, agent connection details, rule names, and protocol errors across the multi-tenant deployment.

AnalysisAI

Cross-tenant information disclosure in OpenRemote versions before 1.26.2 allows any authenticated user holding the read:rules role to retrieve operational syslog events from arbitrary tenants by querying the GET /api/{realm}/syslog/event endpoint. The SyslogResource REST endpoint fails to scope log retrieval to the caller's own realm, exposing asset IDs, agent connection details, rule names, and protocol errors belonging to other organizations in the same multi-tenant deployment. No public exploit code or active exploitation has been identified at time of analysis; the vendor has addressed the issue in version 1.26.2.

Technical ContextAI

OpenRemote is an open-source IoT management platform built around a multi-tenant realm model, where each organization occupies an isolated realm with its own assets, agents, and rules. The SyslogResource component exposes a REST endpoint intended to provide per-realm operational logging. Due to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), the endpoint omits realm-scoped filtering, meaning a caller authenticated in realm A can pass realm B's identifier in the URL path and receive that tenant's operational log stream. The vulnerable surface is the REST API layer rather than the underlying log store. Affected products are identified by CPE cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:* covering all versions prior to 1.26.2.

RemediationAI

Upgrade to OpenRemote version 1.26.2 or later, which introduces realm-scoped filtering on the SyslogResource endpoint per the vendor advisory at https://github.com/openremote/openremote/security/advisories/GHSA-fv8q-rwj8-2c55. If an immediate upgrade is not possible, administrators should audit and restrict assignment of the read:rules role to the minimum necessary trusted users across all realms, as this role is the direct prerequisite for exploitation. As a compensating control, the GET /api/{realm}/syslog/event endpoint can be blocked at a reverse proxy or API gateway layer for all external callers; the trade-off is that legitimate syslog access will be unavailable to all users until patching is applied. There is no indication from available data that a patch version other than 1.26.2 is required.