Vulnerability Description
OpenRemote versions before 1.26.2 contain an information disclosure vulnerability in the SyslogResource REST endpoint that fails to filter operational logs by realm. Attackers with the read:rules role can access the GET /api/{realm}/syslog/event endpoint to retrieve operational logs from all tenants, exposing asset IDs, agent connection details, rule names, and protocol errors across the multi-tenant deployment.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/openremote/openremote/security/advisories/GHSA-fv8q-rwj8-2c55
- https://www.vulncheck.com/advisories/openremote-before-information-disclosure-vi
- https://github.com/openremote/openremote/security/advisories/GHSA-fv8q-rwj8-2c55
FAQ
What is CVE-2026-65009?
CVE-2026-65009 is a vulnerability with a CVSS score of 4.3 (MEDIUM). OpenRemote versions before 1.26.2 contain an information disclosure vulnerability in the SyslogResource REST endpoint that fails to filter operational logs by realm. Attackers with the read:rules role...
How severe is CVE-2026-65009?
CVE-2026-65009 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-65009?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.