Is CVE-2026-81679 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81679 being exploited in the wild.

How severe is CVE-2026-81679?

High severity, with a CVSS score of 7.7, published 27 August 2026.

Is there a fix for CVE-2026-81679?

A patch was published on 2026-08-27: Version 1.28.0 contains fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-81679 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-81679?

Check whether you run OpenRemote at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81679: OpenRemote cross-realm information disclosure in Notification REST API

CVE-2026-81679 · Severity: high · CVSS 7.7 · Published 2026-08-27

OpenRemote is an open-source IoT platform that manages remote devices and notifications across multiple customer organizations (realms). A flaw in the Notification REST API allows a tenant administrator from one organization to view sensitive notification data—including message content and metadata—from every other organization on the same system. An attacker can exploit this with standard read permissions to extract confidential information without additional privileges or user interaction.

Technologies: OpenRemote. Vendors: OpenRemote.

Quick answers

Is CVE-2026-81679 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81679 being exploited in the wild.
How severe is CVE-2026-81679?: High severity, with a CVSS score of 7.7, published 27 August 2026.
Which products and versions are affected?: OpenRemote before 1.28.0.
Is there a fix for CVE-2026-81679?: A patch was published on 2026-08-27: Version 1.28.0 contains fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81679 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-81679?: Check whether you run OpenRemote at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an access control vulnerability (CWE-200, CWE-284) in the NotificationResourceImpl and NotificationService classes. The root cause is that the realm-scoping guard (min-criteria check) is conditional on the isRemove flag and is skipped for read operations, allowing an unauthenticated query to return SentNotification records from all realms. The SentNotification entity lacks a realm column, and no realm predicate is injected by processCriteria during reads. An attacker with read:admin credentials in one realm can issue a zero-parameter GET request to /api/{callerRealm}/notification and retrieve all tenants' notification metadata and message bodies. The attack requires only network access and a valid per-realm admin token; no super-user or cross-realm privileges are required. Patch: upgrade to version 1.28.0 or later, which enforces realm-based access control on the read path independently of the delete flag.

Affected products

OpenRemote OpenRemote before 1.28.0

Timeline

2026-08-27: disclosed
2026-08-27: patched: Version 1.28.0 contains fix
2026-08-13: advisory: GitHub Security Advisory GHSA-6ff4-4frc-r287

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.