OpsTree REMS: Missing authentication in Governance API exposes database credentials
Summary
OpsTree REMS up to and including version 1.0.0 does not properly enforce authentication on Governance API endpoints such as /api/v1/databases. An unauthenticated remote attacker can send requests without an Authorization header or with invalid or tampered JWT tokens and retrieve stored database hosts, usernames and passwords. No special conditions beyond network access to the REMS service are described in the CVE record.
Affected
- OpsTree REMS 0 through 1.0.0 (CVE record, default: unaffected)
Fixed in
- Unknown. No fixed version was found in the sources. Ask OpsTree Solutions directly.
Workaround
- No vendor workaround known.
- Restrict access to the Governance API through network controls, such as limiting REMS to internal management networks or VPN.
- Do not expose REMS to the internet.
Exploitation
- No known exploitation in the wild reported by aggregator sources; not checked against CISA KEV.
- Public technical details may exist; a proof of concept could not be confirmed. Assume a low bar for exploitation.
Our recommendation
- Check whether any OpsTree REMS instance is reachable from the internet or untrusted networks and restrict access immediately.
- Treat internet-exposed instances as high priority and internal-only instances as medium priority.
- Rotate database credentials stored in REMS, as the exposed data includes passwords.
- Review access logs for unauthenticated requests to /api/v1/databases.
- Ask OpsTree Solutions for a fix or advisory and apply updates once available.
- Assess related REMS CVEs published the same day together with this one.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-126769 www.cve.org
- VulnCheck advisory www.vulncheck.com
- OpsTree REMS product page opstree.com
- OffSeq Radar: CVE-2026-126769 radar.offseq.com
- VulDB entry 435926 vuldb.com
- threatint CVE-2026-126769 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:26.
Original description (NVD)
OpsTree REMS through 1.0.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access Governance API endpoints, including /api/v1/databases. Attackers can send requests without an Authorization header, or with invalid or tampered JWT tokens, to retrieve stored database hosts, usernames, and passwords.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.