Is CVE-2026-126766 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126766 being exploited in the wild.

How severe is CVE-2026-126766?

Medium severity, with a CVSS score of 4.3, published 11 November 2026.

Is there a fix for CVE-2026-126766?

No fixed version is recorded yet. Derive the reporter identity exclusively from the authenticated server-side session or token rather than accepting client-supplied values; reject or ignore client-controlled reporter fields in all API requests. [{"kind":"disclosed","at":"2026-09-20"},{"kind":"advisory","at":"2026-11-11"},{"kind":"patched","note":"Vendor confirmed full remediation; fixed version not publicly specified"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-126766 attacked?

It is attacked over the network.

Am I affected by CVE-2026-126766?

Check whether you run OpsTree REMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126766: OpsTree REMS improper authorization in incident creation

CVE-2026-126766 · Severity: medium · CVSS 4.3 · Published 2026-11-11

OpsTree REMS is an AI-powered observability platform used to detect and diagnose infrastructure incidents. An authenticated user can falsely attribute incidents to other users by manipulating the reporter field during incident creation, corrupting audit trails and accountability records. This could allow an insider to frame other team members or hide their involvement in incidents.

Technologies: OpsTree REMS. Vendors: OpsTree.

Quick answers

Is CVE-2026-126766 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126766 being exploited in the wild.
How severe is CVE-2026-126766?: Medium severity, with a CVSS score of 4.3, published 11 November 2026.
Which products and versions are affected?: OpsTree REMS through 1.0.0.
Is there a fix for CVE-2026-126766?: No fixed version is recorded yet. Derive the reporter identity exclusively from the authenticated server-side session or token rather than accepting client-supplied values; reject or ignore client-controlled reporter fields in all API requests.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-20"},{"kind":"advisory","at":"2026-11-11"},{"kind":"patched","note":"Vendor confirmed full remediation; fixed version not publicly specified"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-126766 attacked?: It is attacked over the network.
Am I affected by CVE-2026-126766?: Check whether you run OpsTree REMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Derive the reporter identity exclusively from the authenticated server-side session or token rather than accepting client-supplied values; reject or ignore client-controlled reporter fields in all API requests.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-20"},{"kind":"advisory","at":"2026-11-11"},{"kind":"patched","note":"Vendor confirmed full remediation; fixed version not publicly specified"}]

Technical details

The incident creation API (POST /api/v1/incidents and PATCH /api/v1/incidents/{id}/status) accepts a client-controlled reporter field instead of deriving the reporter identity from server-side authenticated session state. An authenticated attacker can supply an arbitrary reporter value to attribute incidents to any user, bypassing authorization checks on identity fields. This is CWE-639 authorization bypass through user-controlled keys.

Affected products

OpsTree REMS through 1.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.