OpenRemote Manager: Missing authorization in gateway tunnel endpoints
Summary
Four of five gateway tunnel endpoints in OpenRemote Manager have no authorization check, including the endpoints that start and stop tunnels. Any authenticated user, even one without an administrative role, can open a persistent bidirectional TCP tunnel into an edge gateway's network and tear down tunnels used by operators. The CVSS 4.0 score of 9.0 (Critical) is from NVD and VulnCheck; the advisory's own exploitability details are not fully confirmed.
Affected
- OpenRemote 1.2.0 up to but excluding 1.31.0 (openremote-manager, Maven: io.openremote)
- Per the advisory, all releases including gateway tunnelling from 1.2.0 through 1.30.1 are affected
Fixed in
- Fixed in OpenRemote 1.31.0
- Upgrade caveat: 1.31.0 adds the roles read:tunnels and write:tunnels. Users without full READ and/or WRITE access (composite roles) lose access to all tunnelling features until these roles are assigned, either in the Manager UI users page or in Keycloak.
Workaround
- No vendor workaround found. The advisory's only remediation is the upgrade to 1.31.0.
- Interim measures (not from vendor sources): restrict which accounts exist on the manager and limit network access to the manager API, for example with a reverse proxy allow-list.
Exploitation
- Not marked as known exploited (KEV: No) in the sources reviewed.
- CISA SSVC: exploitation status poc, automatable no, technical impact total.
- The GitHub advisory contains request-level reproduction details; no separate public exploit repository was found.
Our recommendation
- Identify all OpenRemote instances and edge gateways, and check for versions from 1.2.0 up to 1.30.x.
- Plan the upgrade to 1.31.0 and prepare the new read:tunnels and write:tunnels roles beforehand so that users keep access.
- Until patched, review user accounts (remove shared or over-privileged accounts) and restrict network exposure of the manager.
- Review existing gateway tunnels and access logs for unexpected tunnel activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-5h8w-vg25-fw38 github.com
- VulnCheck advisory: OpenRemote Missing Authorization in Gateway Tunnel Endpoints www.vulncheck.com
- OpenRemote release 1.31.0 github.com
- CVE-2026-114661 summary (threatint) cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:04.
Original description (NVD)
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open persistent bidirectional TCP circuits into an edge gateway's network or tear down operator tunnels.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.