OpsTree REMS: Authentication bypass via client-controlled is_local_auth flag
Summary
OpsTree REMS, an AI-powered observability platform, trusts a flag that the client controls during login. An unauthenticated attacker can send a login request for the admin account with an invalid password and is_local_auth set to true, receive a valid JWT and gain SuperUser access. Successful exploitation can expose the governance database, incident management, AI/LLM administration and user management.
Affected
- OpsTree Solutions REMS, versions 0 through 1.0.0 (according to the CVE record)
Fixed in
- Unknown. No vendor advisory or fixed version has been found yet.
Workaround
- Take REMS off the internet and place it behind a VPN or an identity-aware proxy.
- Restrict access to the login API endpoint (POST /api/v1/user/login/) by IP address.
- Monitor logs for login attempts that involve the is_local_auth field and for successful admin logins from unexpected sources.
Exploitation
- A public gist with technical details exists, but its exploit content has not been verified. Sources disagree on whether a public exploit exists.
- Not known to be exploited in the wild, according to OffSeq.
- No attack exploitation data available from the vendor.
Our recommendation
- Check whether REMS is deployed, whether it is reachable from the internet, and who holds admin accounts.
- Restrict exposure now, as no patch is known, and monitor for suspicious logins.
- Rotate the admin password and any JWT signing secrets if exposure is suspected, and treat admin sessions from the exposed period as possibly compromised.
- Also check CVE-2026-126769 (missing authentication in the Governance API), which affects the same product.
- Apply the vendor fix as soon as OpsTree publishes it.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-126768 www.cve.org
- VulnCheck advisory: OpsTree REMS authentication bypass www.vulncheck.com
- Researcher advisory (GitHub gist) gist.github.com
- OpsTree REMS product page opstree.com
- VulDB entry CVE-2026-126768 vuldb.com
- OffSeq radar entry CVE-2026-126768 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:21.
Original description (NVD)
OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the client-controlled is_local_auth field. Attackers can send a POST /api/v1/user/login/ request for the admin account with an invalid password and is_local_auth true to gain SuperUser administrative access.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.