OpenRemote Gateway Tunnel Flaw Lets Authenticated Users Control Network Access

The National Vulnerability Database has recorded a critical security flaw in OpenRemote software that allows authenticated users to bypass administrative controls for gateway tunnels. Identified as CVE-2026-114661, the issue carries a CVSS score of 9, indicating severe potential impact on system integrity and availability.

The vulnerability stems from missing authorization checks within the GatewayServiceResource component of the platform. According to the NVD record, this weakness corresponds to CWE-862, which describes a failure to properly restrict actions based on user roles. This allows standard users to perform actions that should be reserved for administrators only.

Technical Details and Impact

Attackers who have obtained valid credentials can exploit this flaw by sending POST or DELETE requests to the gateway tunnel endpoint. These requests allow the user to start, stop, or query gateway tunnels without possessing an administrative role. This capability significantly lowers the barrier for malicious actors to interfere with network operations.

The most severe consequence of this exploitation is the ability to open persistent bidirectional TCP circuits into an edge gateway's network. This effectively grants an unauthorized user a direct pathway into the internal network infrastructure. Additionally, attackers can use the same mechanism to tear down existing operator tunnels, disrupting legitimate communication flows and potentially causing denial of service conditions.

Affected Versions

The vulnerability affects all versions of OpenRemote prior to version 1.31.0. The NVD record explicitly lists the affected range as "before 1.31.0". Organizations running any iteration of the software earlier than this version are considered exposed to this specific authorization bypass.

Users should verify their current installation version immediately to determine if they fall within the vulnerable range. The record does not specify when the vulnerability was introduced in earlier builds, so any version below the cutoff is at risk. No other product lines or third-party components are mentioned in the advisory.

What should you do?

Security teams should audit their OpenRemote installations to confirm the version number against the vulnerable range. If the software version is below 1.31.0, the environment is susceptible to the described tunnel manipulation attacks. Organizations should prioritize restricting access to the gateway tunnel endpoints through network segmentation or firewall rules until a software update is available.