OpsTree REMS: Server-side request forgery via database Test Connection
Summary
OpsTree REMS through version 1.0.0 contains a server-side request forgery (SSRF) flaw in the database Test Connection feature. An authenticated user can set a database entry's host and port to localhost, internal addresses or attacker-controlled servers, so the REMS backend connects to them. This allows probing of internal hosts and ports reachable from the REMS server, but the CVSS impact is limited to confidentiality.
Affected
- OpsTree REMS 0 through 1.0.0 (according to the CNA record)
Fixed in
Unknown. No vendor patch or fixed version was found at the time of writing.
Workaround
- Restrict who can create or edit database entries in REMS.
- Block outbound connections from the REMS server to internal networks, localhost and cloud metadata addresses using host or network egress rules.
- Limit access to the REMS web interface to management networks or VPN.
- Monitor use of the database Test Connection function.
Exploitation
- No known exploitation in the wild.
- Public proof of concept: sources conflict. VulDB reports no public exploit; the CVE record references a gist that may contain technical details. Verify manually before relying on either claim.
Our recommendation
- If REMS is in use, treat this as a priority review and confirm the installed version with OpsTree.
- Apply the workarounds above until a fixed version is confirmed.
- Check whether the REMS server can reach internal services or metadata endpoints that it does not need to reach.
- Monitor REMS logs for unusual database connection requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-126770 www.cve.org
- VulnCheck advisory: OpsTree REMS SSRF via Database Test Connection www.vulncheck.com
- Security advisory gist (REMS-CVE-7) gist.github.com
- OpsTree REMS product page opstree.com
- VulDB entry CVE-2026-126770 vuldb.com
- OffSeq Radar: CVE-2026-126770 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:45.
Original description (NVD)
OpsTree REMS through 1.0.0 contains a server-side request forgery vulnerability that allows authenticated users to make the backend connect to arbitrary destinations through the database Test Connection feature. Attackers can set a database entry's host and port to localhost, internal addresses, or attacker-controlled servers to probe internal hosts and ports reachable from the REMS server.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.