What is GHSA-6f5f-g69g-4546?

GHSA-6f5f-g69g-4546 is a security advisory published by GitHub Security Advisories with Medium severity. OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows...

Which CVE IDs does GHSA-6f5f-g69g-4546 cover?

GHSA-6f5f-g69g-4546 covers the following CVE IDs: CVE-2026-116185. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6f5f-g69g-4546?

GHSA-6f5f-g69g-4546 has a CVSS v3 base score of 5.0, published by GitHub Security Advisories.

GHSA-6f5f-g69g-4546MediumCVSS 5.0

OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows...

Vendor

GitHub Security Advisories

Published

October 25, 2026

Last Modified

October 25, 2026

🔗 CVE IDs covered (1)

CVE-2026-116185 →

📋 Description

OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own realm and a victim gateway ID to disclose internal target hosts, ports, and routing data.

🔗 References (4)

https://github.com/openremote/core/security/advisories/GHSA-p5wh-9wx4-w5f3
https://nvd.nist.gov/vuln/detail/CVE-2026-116185
https://www.vulncheck.com/advisories/openremote-before-1.31.0-cross-realm-information-disclosure-via-getgatewayactivetunnelinfos
https://github.com/advisories/GHSA-6f5f-g69g-4546