# CVE-2026-126766: OpsTree REMS improper authorization in incident creation

Source: https://junglewise.ai/threats/cve-2026-126766-opstree-rems-through-1-0-0-contains-an-improper-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-126766 · Severity: medium · CVSS 4.3 · Published 2026-11-11

OpsTree REMS is an AI-powered observability platform used to detect and diagnose infrastructure incidents. An authenticated user can falsely attribute incidents to other users by manipulating the reporter field during incident creation, corrupting audit trails and accountability records. This could allow an insider to frame other team members or hide their involvement in incidents.

Technologies: [OpsTree REMS](https://junglewise.ai/threats/technologies/opstree-rems). Vendors: [OpsTree](https://junglewise.ai/threats/vendors/opstree).

## Quick answers

**Is CVE-2026-126766 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126766 being exploited in the wild.

**How severe is CVE-2026-126766?** Medium severity, with a CVSS score of 4.3, published 11 November 2026.

**Which products and versions are affected?** OpsTree REMS through 1.0.0.

**Is there a fix for CVE-2026-126766?** No fixed version is recorded yet. Derive the reporter identity exclusively from the authenticated server-side session or token rather than accepting client-supplied values; reject or ignore client-controlled reporter fields in all API requests.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-09-20"},{"kind":"advisory","at":"2026-11-11"},{"kind":"patched","note":"Vendor confirmed full remediation; fixed version not publicly specified"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-126766 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-126766?** Check whether you run OpsTree REMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Derive the reporter identity exclusively from the authenticated server-side session or token rather than accepting client-supplied values; reject or ignore client-controlled reporter fields in all API requests.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-09-20"},{"kind":"advisory","at":"2026-11-11"},{"kind":"patched","note":"Vendor confirmed full remediation; fixed version not publicly specified"}]

## Technical details

The incident creation API (POST /api/v1/incidents and PATCH /api/v1/incidents/{id}/status) accepts a client-controlled reporter field instead of deriving the reporter identity from server-side authenticated session state. An authenticated attacker can supply an arbitrary reporter value to attribute incidents to any user, bypassing authorization checks on identity fields. This is CWE-639 authorization bypass through user-controlled keys.

## Affected products

- OpsTree REMS through 1.0.0

## References

- [https://gist.github.com/neelkotnis/e11fb4f70d8ec850fa601566b95472a4](https://gist.github.com/neelkotnis/e11fb4f70d8ec850fa601566b95472a4)
- [https://opstree.com/rems-ai-powered-observability/](https://opstree.com/rems-ai-powered-observability/)

## Related threats

- [OpsTree REMS incorrect comment attribution](https://junglewise.ai/threats/cve-2026-126772-opstree-rems-through-1-0-0-contains-an-improper-attribution)
- [OpsTree REMS stored cross-site scripting in file preview](https://junglewise.ai/threats/cve-2026-126771-opstree-rems-through-1-0-0-contains-a-stored-cross-site)
- [OpsTree REMS server-side request forgery in database test connection](https://junglewise.ai/threats/cve-2026-126770-opstree-rems-through-1-0-0-contains-a-server-side-request)
- [OpsTree REMS prompt injection vulnerability in RCA Chat](https://junglewise.ai/threats/cve-2026-126767-opstree-rems-through-1-0-0-contains-a-prompt-injection)