External risk intelligence

OpenRemote Gateway Tunnel Missing Authorization Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-114661

The vulnerability affects an edge gateway service designed to manage network tunnels. Such services are commonly deployed as internet-facing or edge-accessible components to facilitate remote connectivity and management, making them a likely target for external interaction.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in OpenRemote software that allows authenticated users to bypass authorization controls for gateway tunnels. This could enable unauthorized access to or disruption of network connections managed by the affected service. The main concern is confirming relevance and exposure.

Unrestricted tunnel control by authenticated users.
Affects secure remote access and management.
Confirm relevance and exposure for critical systems.

Attack Path

How an attacker could exploit the issue

An attacker with existing user credentials can leverage this vulnerability to manipulate gateway tunnels. By sending specific requests to the gateway tunnel endpoint, an attacker can establish persistent network connections into an edge gateway's network, or disrupt existing connections.

Authenticated user access required.
Manipulate gateway tunnel endpoints.
Establish persistent network circuits.

Live Threat

Current exploitation, exposure, and threat context

A missing authorization vulnerability in OpenRemote's GatewayServiceResource could allow any authenticated user to manipulate gateway tunnels, potentially enabling persistent bidirectional TCP circuits into an edge gateway's network or disrupting existing tunnels. This could occur when an authenticated user interacts with the gateway tunnel endpoint.

Gateway tunnel configurations and network access.
Authenticated users can send requests to endpoints.
Persistent tunnels or tunnel disruptions.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in OpenRemote's GatewayServiceResource impacts systems where authenticated users can manipulate gateway tunnels. The first step is to identify all instances of OpenRemote, determine their accessibility, assess business criticality, and pinpoint the accountable team before planning remediation.

Application owners should investigate usage.
Verify gateway tunnel accessibility and impact.
Plan coordinated remediation or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenRemote and how is it used?

OpenRemote is an IoT platform used for managing, controlling, and monitoring connected devices and energy systems. It serves as a central hub for automation, frequently deploying edge gateways to facilitate remote connectivity and data exchange between local networks and the broader infrastructure.

What does CWE-862 mean for CVE-2026-114661?

CWE-862 refers to a missing authorization weakness. In the context of this CVE, it means the software fails to verify if a user has the appropriate administrative permissions before granting them access to sensitive functions. Consequently, any standard authenticated user can perform actions intended only for authorized administrators.

How can an attacker trigger this vulnerability?

An attacker needs existing valid credentials to the system. By sending unauthorized POST or DELETE requests to the GatewayServiceResource endpoint, they can manipulate gateway tunnels. Note that simply being a guest or having no credentials will not trigger this bug; the attacker must be logged into the platform.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates a 'Likely' risk rating because OpenRemote gateway services are typically placed at the edge of a network to enable remote management. If your instance is internet-facing or edge-accessible, it is a prime target for interaction, increasing the importance of verifying your setup.

What should I do if I run OpenRemote?

Start by auditing your environment to locate all running instances of OpenRemote. Evaluate which systems are internet-facing and determine the business criticality of their gateway configurations. Coordinate with your engineering teams to prioritize these instances for security updates once a fix is available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.