Is CVE-2026-126772 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126772 being exploited in the wild.

How severe is CVE-2026-126772?

Medium severity, with a CVSS score of 4.3, published 11 November 2026.

How is CVE-2026-126772 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-126772?

Check whether you run OpsTree REMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126772: OpsTree REMS incorrect comment attribution

CVE-2026-126772 · Severity: medium · CVSS 4.3 · Published 2026-11-11

OpsTree REMS is an observability platform used to track and resolve incidents. The vulnerability allows authenticated users to post comments on incidents while having those comments falsely attributed to the original incident creator, corrupting audit trails and undermining accountability during incident investigations and response.

Technologies: OpsTree REMS. Vendors: OpsTree.

Quick answers

Is CVE-2026-126772 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126772 being exploited in the wild.
How severe is CVE-2026-126772?: Medium severity, with a CVSS score of 4.3, published 11 November 2026.
Which products and versions are affected?: OpsTree REMS through 1.0.0.
Is there a fix for CVE-2026-126772?: A patch was published: OpsTree Solutions has patched the vulnerability Until you apply it: Derive the comment author from the authenticated session identity on the server side and do not trust client-supplied identity values or inherit the incident creator's identity when recording comment authorship. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126772 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-126772?: Check whether you run OpsTree REMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Derive the comment author from the authenticated session identity on the server side and do not trust client-supplied identity values or inherit the incident creator's identity when recording comment authorship.

Technical details

The vulnerability is an improper authorization / incorrect attribution flaw in the POST /api/v1/incidents/{incident_id}/comment endpoint. An authenticated attacker can submit a comment on another user's incident, but the application incorrectly attributes the comment to the incident creator rather than the authenticated submitter, due to server-side logic that inherits the incident owner's identity instead of deriving the comment author from the authenticated session. This requires authentication but allows lower-privileged users to impersonate higher-privileged ones in the incident timeline.

Affected products

OpsTree REMS through 1.0.0

Timeline

2026-09-20: disclosed
2026-11-11: advisory
patched: OpsTree Solutions has patched the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.