Is CVE-2026-116185 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116185 being exploited in the wild.

How severe is CVE-2026-116185?

Medium severity, with a CVSS score of 5, published 25 October 2026.

Is there a fix for CVE-2026-116185?

Yes: fixed in 1.31.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116185 attacked?

It is attacked over the network.

Am I affected by CVE-2026-116185?

Check whether you run OpenRemote Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116185: OpenRemote core authorization bypass in gateway tunnel endpoint

CVE-2026-116185 · Severity: medium · CVSS 5 · Published 2026-10-25

OpenRemote core is a building automation and IoT management platform that isolates data and access by realm (tenant). An authorization flaw in the gateway tunnel-info API allows any authenticated user to bypass realm isolation and view internal routing information—target hosts, ports, and gateway data—from other tenants' gateways if they know the gateway ID. This crosses tenant security boundaries and exposes sensitive infrastructure details an attacker's realm should not access.

Technologies: OpenRemote Core. Vendors: OpenRemote.

Quick answers

Is CVE-2026-116185 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116185 being exploited in the wild.
How severe is CVE-2026-116185?: Medium severity, with a CVSS score of 5, published 25 October 2026.
Which products and versions are affected?: OpenRemote Core before 1.31.0.
Is there a fix for CVE-2026-116185?: Yes: fixed in 1.31.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116185 attacked?: It is attacked over the network.
Am I affected by CVE-2026-116185?: Check whether you run OpenRemote Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.31.0

Technical details

The REST endpoint GET /gateway/tunnel/{realm}/{id} (GatewayServiceResourceImpl.getGatewayActiveTunnelInfos) lacks realm-scoping on the returned tunnel set; it validates the caller's own realm matches the path parameter but then queries gatewayService.getGatewayTunnelInfos(gatewayId) without filtering by realm. An authenticated user in realm A can supply their own realm and a gateway ID from realm B, receiving realm B's tunnel metadata. Sibling endpoints (getAllActiveTunnelInfos, getActiveTunnelInfo) correctly apply the realm predicate; this method omits it entirely (CWE-639, CWE-284). Precondition: attacker must know a target gateway ID (22-character identifier, potentially discoverable via logs or shared links).

Affected products

OpenRemote core before 1.31.0

Timeline

2026-10-08: disclosed
2026-10-25: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.