CVE-2026-116186 OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116186?
CVE-2026-116186 is a low-severity vulnerability in openremote core, published on 25 Oct 2026.
Official description
OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image IDs in AttributeEvent or DELETE AssetEvent messages to overwrite attributes on, or delete, assets in any realm, breaking tenant isolation.
Weakness: CWE-639
Which versions are affected by CVE-2026-116186?
How do I fix CVE-2026-116186?
No fix has been published for CVE-2026-116186 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116186 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-116186 exists.
Sources
Also known as GHSA-8pjc-wq2p-3xr4, GHSA-pqvx-525p-jf88.