CVE-2026-54640 Overview
OpenRemote, an open-source Internet-of-Things (IoT) platform, contains an XML External Entity (XXE) vulnerability in its KNX protocol handler. The flaw affects versions prior to 1.24.2. The KNXProtocol.startAssetImport method processes 0.xml from an authenticated user's uploaded Engineering Tool Software (ETS) project ZIP using Saxon TransformerFactoryImpl and XMLInputFactory parsers that permit external entity resolution. This represents an incomplete remediation of CVE-2026-40882, which left the KNX handler unprotected while the parallel Velbus handler received hardening. A regular realm user can exploit the flaw to read files accessible to the JVM process or trigger server-side requests [CWE-611].
Critical Impact
An authenticated low-privileged user can read arbitrary local files accessible to the OpenRemote JVM process or force the server to perform outbound requests through crafted ETS project uploads.
Affected Products
- OpenRemote core versions prior to 1.24.2
- KNX protocol agent (agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java)
- Deployments accepting ETS project ZIP imports from authenticated realm users
Discovery Timeline
- 2026-10-13 - CVE-2026-54640 published to the National Vulnerability Database (NVD)
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-54640
Vulnerability Analysis
The vulnerability resides in the KNX asset import workflow. When an authenticated user uploads an ETS project archive, OpenRemote extracts the archive and parses the embedded 0.xml descriptor. The parser stack combines Saxon's TransformerFactoryImpl with a XMLInputFactory configuration that leaves external entity resolution enabled.
An attacker can craft an ETS ZIP containing a malicious 0.xml with external entity declarations. The parser then dereferences those entities during import. This allows the attacker to exfiltrate local files readable by the JVM user or coerce the server into issuing HTTP or other protocol requests to internal network destinations.
The fix for CVE-2026-40882 hardened the parallel Velbus handler but did not apply equivalent entity-resolution restrictions to the KNX handler. OpenRemote released version 1.24.2 to close the remaining gap.
Root Cause
The root cause is improper restriction of XML external entity references in the KNX import pipeline. Neither TransformerFactoryImpl nor XMLInputFactory had the secure-processing or IS_SUPPORTING_EXTERNAL_ENTITIES features disabled before parsing untrusted project files.
Attack Vector
Exploitation requires an authenticated user with permissions to import KNX assets into a realm. The attacker uploads a crafted ETS project ZIP whose 0.xml references external entities pointing to local files such as /etc/passwd or internal URLs. Parser dereferencing returns the contents to the attacker or forces outbound server-side requests, enabling local file disclosure and Server-Side Request Forgery (SSRF).
See the GitHub Security Advisory GHSA-7v6w-c3f4-9wpq for additional technical context.
Detection Methods for CVE-2026-54640
Indicators of Compromise
- ETS project ZIP uploads containing 0.xml files with <!DOCTYPE> declarations or <!ENTITY> definitions referencing file://, http://, or https:// URIs
- Unexpected outbound network connections from the OpenRemote JVM process immediately following a KNX asset import
- Application logs showing KNX import operations initiated by low-privileged realm users
Detection Strategies
- Inspect uploaded ETS archives at an ingress proxy or WAF for XML documents containing external entity declarations
- Correlate startAssetImport activity in OpenRemote logs with filesystem access to sensitive paths such as /etc/, /root/, or application configuration directories
- Monitor for anomalous DNS lookups or HTTP egress originating from the OpenRemote host immediately after import events
Monitoring Recommendations
- Enable verbose logging on the KNX agent and forward events to a centralized Security Information and Event Management (SIEM) platform
- Baseline normal KNX import frequency per realm user and alert on deviations
- Monitor JVM process file descriptors and outbound socket activity during XML parsing operations
How to Mitigate CVE-2026-54640
Immediate Actions Required
- Upgrade OpenRemote to version 1.24.2 or later without delay
- Audit realm user permissions and restrict KNX asset import rights to trusted operators only
- Review historical import logs for suspicious ETS uploads since the deployment of affected versions
Patch Information
The fix is included in OpenRemote 1.24.2. Review the GitHub commit and the v1.24.2 release notes for full remediation details. The patch disables external entity resolution in the Saxon TransformerFactoryImpl and XMLInputFactory instances used by KNXProtocol.startAssetImport.
Workarounds
- Temporarily disable the KNX protocol agent if upgrading is not immediately feasible
- Block ETS project uploads at a reverse proxy until the patched version is deployed
- Restrict egress network access from the OpenRemote JVM host to limit SSRF impact
# Verify installed OpenRemote version meets the fixed baseline
docker exec openremote cat /opt/app/VERSION
# Expected output: 1.24.2 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
