Openremote vulnerabilities
We track 12 vulnerabilities in Openremote products across 2 products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on November 8, 2026.
Latest Openremote vulnerabilities
- 8.0 High severity
core: Incorrect Authorization
OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resources by calling admin endpoints lacking super administrator checks. Attackers can change the global keycloakUrl via /con
- 7.2 High severity
openremote: Improper Neutralization of Special Elements used in an SQL Command
OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the `datapoint export` API constructs `CSV crosstab` SQL by concatenating an `asset name` and `attribute name` into a `COPY` query that uses `crosstab` and streams `TO STDOUT`. The `ass
- 8.5 High severity
openremote: Missing Authorization
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to th
- 7.7 High severity
openremote: Authorization Bypass Through User-Controlled Key
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with the read:admin role with
- 7.6 High severity
openremote: Improper Restriction of XML External Entity Reference
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP w
- 7.7 High severity
openremote: Exposure of Sensitive Information to an Unauthorized Actor
OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin cr
- 9.3 Critical severity
openremote: Authorization Bypass Through User-Controlled Key
OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification to
- 8.8 High severity
openremote: Improper Neutralization of Special Elements used in an SQL Command
OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or renam
- 8.1 High severity
openremote: Authorization Bypass Through User-Controlled Key
OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. The removeA
- 7.0 High severity
openremote: Improper Access Control
OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.1, a user who has `write:admin` in one Keycloak realm can call the Manager API to update Keycloak realm roles for users in another realm, including `master`. The handler uses the `
- 7.6 High severity
openremote: Improper Restriction of XML External Entity Reference
OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.0, the Velbus asset import path parses attacker-controlled XML without explicit XXE hardening. An authenticated user who can call the import endpoint may trigger XML external entit
- 9.9 Critical severity
openremote: Improper Control of Generation of Code
OpenRemote is an open-source IoT platform. Versions 1.21.0 and below contain two interrelated expression injection vulnerabilities in the rules engine that allow arbitrary code execution on the server. The JavaScript rules engine executes user-supplied scripts