# CVE-2026-40882: OpenRemote has XXE in Velbus Asset Import

Source: https://junglewise.ai/threats/cve-2026-40882-openremote-has-xxe-in-velbus-asset-import  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-22. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-40882 · Severity: high · CVSS 7.6 · Published 2026-04-22

OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.0, the Velbus asset import path parses attacker-controlled XML without explicit XXE hardening. An authenticated user who can call the import endpoint may trigger XML external entity processing, which can lead to server-side file disclosure and SSRF. The target file must be less than 1023 characters. Version 1.22.0 fixes the issue.

Technologies: [io.openremote:openremote-manager (Maven)](https://junglewise.ai/threats/technologies/io-openremote-openremote-manager), [OpenRemote](https://junglewise.ai/threats/technologies/openremote). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [OpenRemote](https://junglewise.ai/threats/vendors/openremote).

## Quick answers

**Is CVE-2026-40882 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40882 being exploited in the wild.

**How severe is CVE-2026-40882?** High severity, with a CVSS score of 7.6, published 22 April 2026.

**Which products and versions are affected?** io.openremote:openremote-manager (Maven) <= 1.21.0, ECOSYSTEM:introduced=0,fixed=1.22.0.

**Is there a fix for CVE-2026-40882?** Yes. io.openremote:openremote-manager (Maven): upgrade to 1.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-40882?** Check whether you run io.openremote:openremote-manager (Maven) or OpenRemote at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- io.openremote:openremote-manager (Maven): upgrade to 1.22.0 or later

  ```sh
  # set io.openremote:openremote-manager to 1.22.0 in your pom.xml or build.gradle
  ```


## Affected products

- io.openremote:openremote-manager (Maven) <= 1.21.0, ECOSYSTEM:introduced=0,fixed=1.22.0
- OpenRemote

## Identifiers

- CVE-2026-40882
- GHSA-g24f-mgc3-jwwc

## References

- [https://api.github.com/users/KKC73](https://api.github.com/users/KKC73)
- [https://github.com/KKC73](https://github.com/KKC73)
- [https://api.github.com/users/KKC73/gists%7B/gist_id%7D](https://api.github.com/users/KKC73/gists%7B/gist_id%7D)
- [https://api.github.com/users/KKC73/repos](https://api.github.com/users/KKC73/repos)
- [https://avatars.githubusercontent.com/u/50138914?v=4](https://avatars.githubusercontent.com/u/50138914?v=4)
- [https://api.github.com/users/KKC73/events%7B/privacy%7D](https://api.github.com/users/KKC73/events%7B/privacy%7D)

## Related threats

- [OpenRemote authenticated SQL injection in datapoint export](https://junglewise.ai/threats/cve-2026-63224-openremote-is-an-open-source-internet-of-things-platform-prior-to)
- [OpenRemote Cross-Realm User Information Disclosure in UserResourceImpl](https://junglewise.ai/threats/cve-2026-54641-openremote-cross-realm-user-information-disclosure-in)
- [OpenRemote missing authorization for predicted datapoint writes](https://junglewise.ai/threats/cve-2026-49439-openremote-missing-authorization-for-predicted-datapoint-writes)
- [OpenRemote cross-realm information disclosure in Notification REST API](https://junglewise.ai/threats/cve-2026-81679-openremote-cross-realm-information-disclosure-in-notification)
- [OpenRemote notification deletion cross-realm authorization bypass](https://junglewise.ai/threats/cve-2026-73616-openremote-notification-deletion-cross-realm-authorization-bypass)