CVE-2026-39842: OpenRemote IoT Platform RCE Vulnerability

CVE-2026-39842 Overview

CVE-2026-39842 is a critical expression injection vulnerability affecting OpenRemote, an open-source IoT platform. The vulnerability consists of two interrelated security flaws in the rules engine that allow arbitrary code execution on the server. A non-superuser attacker with the write:rules role can exploit these flaws to achieve remote code execution with root privileges, arbitrary file read access, credential theft, and complete multi-tenant isolation bypass.

Critical Impact

Remote code execution with full JVM access enables attackers to execute commands as root, read arbitrary files, steal environment variables including database credentials, and bypass multi-tenant isolation to access data across all realms.

Affected Products

• OpenRemote versions 1.21.0 and below
• OpenRemote IoT Platform (all deployments with rules engine enabled)
• Multi-tenant OpenRemote installations

Discovery Timeline

• 2026-04-15 - CVE-2026-39842 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-39842

Vulnerability Analysis

This vulnerability stems from two interrelated expression injection flaws (CWE-94: Code Injection) in the OpenRemote rules engine. The first issue involves the JavaScript rules engine executing user-supplied scripts via Nashorn's ScriptEngine.eval() method without implementing any sandboxing, class filtering, or access restrictions. This allows JavaScript code to run with full JVM access, breaking out of the expected execution sandbox.

The second component involves a flawed authorization mechanism in RulesResourceImpl. While the authorization check properly restricts Groovy rules to superusers only, JavaScript rules remain completely unrestricted for any user possessing the write:rules role. This permission disparity creates a significant attack surface.

Additionally, the Groovy rules engine contains a GroovyDenyAllFilter security filter that is defined in the codebase but never actually registered—the registration code has been commented out. This renders the SandboxTransformer completely ineffective, even for Groovy rules created by superusers.

Root Cause

The root cause is a combination of missing input validation and improper security control implementation. The JavaScript rules engine fails to implement proper sandboxing when evaluating user-supplied scripts through Nashorn's ScriptEngine.eval(). Additionally, the authorization logic in RulesResourceImpl contains an incomplete access control check that only validates superuser status for Groovy rules while leaving JavaScript rules accessible to lower-privileged users. The commented-out registration code for GroovyDenyAllFilter indicates a security control that was designed but never properly deployed.

Attack Vector

The attack can be performed remotely over the network by any authenticated user with the write:rules role. The attacker creates a JavaScript ruleset through the OpenRemote API or interface, embedding malicious code that exploits the unsandboxed ScriptEngine.eval() execution context. Since JavaScript rules bypass the superuser restriction, any user with rule writing permissions can execute arbitrary Java/JavaScript code with the same privileges as the OpenRemote server process—typically root.

The exploitation chain allows:

1. Remote code execution as root on the server
2. Arbitrary file read from the file system
3. Environment variable theft, including database credentials
4. Complete bypass of multi-tenant isolation to access data across all realms

For detailed technical exploitation information, refer to the GitHub Security Advisory GHSA-7mqr-33rv-p3mp.

Detection Methods for CVE-2026-39842

Indicators of Compromise

• Unusual JavaScript ruleset creation events in OpenRemote audit logs
• Rules containing Java class references like java.lang.Runtime, java.io.File, or ProcessBuilder
• Unexpected outbound network connections from the OpenRemote server
• File system access attempts outside normal OpenRemote directories
• Cross-realm data access patterns in multi-tenant deployments

Detection Strategies

• Monitor rule creation and modification events, particularly JavaScript rules created by non-superuser accounts
• Implement log analysis for ruleset content containing suspicious Java class invocations or system command execution patterns
• Deploy network monitoring to detect anomalous outbound connections from the OpenRemote application server
• Review audit logs for users with write:rules permissions creating rules that reference system-level Java packages

Monitoring Recommendations

• Enable verbose logging for the rules engine component and RulesResourceImpl authorization checks
• Implement real-time alerting on JavaScript ruleset creation by non-superuser accounts
• Monitor server process behavior for unexpected child processes or file system access
• Establish baseline network behavior for OpenRemote servers to detect command-and-control communication

How to Mitigate CVE-2026-39842

Immediate Actions Required

• Upgrade to OpenRemote version 1.22.0 or later immediately
• Audit all existing JavaScript rulesets for malicious content
• Review all accounts with the write:rules role and apply principle of least privilege
• Restrict network egress from OpenRemote servers until patched
• Rotate database credentials and other sensitive environment variables if compromise is suspected

Patch Information

OpenRemote has released version 1.22.0 which addresses both expression injection vulnerabilities. The patch implements proper sandboxing for the JavaScript rules engine and corrects the authorization logic to restrict JavaScript rule creation appropriately. The GroovyDenyAllFilter registration has also been properly enabled.

For patch details, see the GitHub Release 1.22.0.

Workarounds

• Remove the write:rules permission from all non-superuser accounts until the patch can be applied
• Disable the JavaScript rules engine entirely if business operations permit
• Implement network segmentation to isolate OpenRemote servers from sensitive internal resources
• Deploy a web application firewall (WAF) to filter ruleset creation requests containing suspicious patterns

# Configuration example - Restrict rules permissions via OpenRemote keycloak realm
# Review and revoke write:rules role from non-essential users
# Access Keycloak admin console for your OpenRemote deployment
# Navigate to: Realm > Users > [user] > Role Mappings
# Remove 'write:rules' role from users who do not require it

# Alternatively, disable JavaScript rules at the application level
# by modifying the rules engine configuration before upgrading
# Consult OpenRemote documentation for deployment-specific instructions