CVE-2026-54641: OpenRemote IoT Platform Auth Bypass Flaw

CVE-2026-54641 Overview

OpenRemote is an open-source Internet of Things (IoT) platform used to build and manage connected device deployments across multiple tenants. CVE-2026-54641 is a broken access control vulnerability [CWE-639] in the UserResourceImpl class that allows a realm administrator to read user data belonging to other tenants. The flaw affects OpenRemote versions prior to 1.24.2 and breaks the platform's tenant isolation model. An authenticated administrator with the read:admin role can query user profiles, client roles, and realm roles across arbitrary realms, including the privileged master realm.

Critical Impact
A realm administrator can enumerate privileged accounts in other tenants and the master realm, exposing credentials metadata and role assignments outside their authorized scope.

Affected Products

OpenRemote Manager prior to version 1.24.2
The get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java
Multi-tenant OpenRemote deployments using Keycloak realm segmentation

Discovery Timeline

2026-10-13 - CVE-2026-54641 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database
Fix released - OpenRemote version 1.24.2 published via GitHub Release 1.24.2

Technical Details for CVE-2026-54641

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) in the OpenRemote Manager user resource. The get, getUserClientRoles, and getUserRealmRoles methods accept a realm parameter and a userId parameter from the request. The implementation verifies that the caller holds the read:admin client role but does not confirm that the supplied userId actually belongs to the requested realm. As a result, an authenticated realm administrator can pass any user UUID, including identifiers from other tenants or the master realm, and the server returns the target account's profile and role assignments. This breaks the tenant isolation boundary that multi-tenant OpenRemote deployments rely on.

Root Cause

The root cause is a missing authorization check between the authenticated principal's realm and the realm that owns the requested user object. Role-based access was treated as sufficient, but object-level ownership was never validated. The fix introduces a throwIfCannotReadUserInRealm(realm, userId) call that rejects requests when the target user does not belong to the specified realm.

Attack Vector

Exploitation requires network access to the OpenRemote Manager API and valid credentials for an account with the read:admin role in any realm. The attacker issues a REST request to the user endpoint, supplying their own realm name together with a user UUID discovered or guessed from another tenant. The server returns the cross-tenant user record, including client and realm role assignments that can reveal privileged master-realm administrators.

java

    @Override
    public User get(RequestParams requestParams, String realm, String userId) {
+        throwIfCannotReadUserInRealm(realm, userId);
+
        boolean hasAdminReadRole = hasResourceRole(ClientRole.READ_ADMIN.getValue(), Constants.KEYCLOAK_CLIENT_ID);

        if (!hasAdminReadRole && !Objects.equals(getUserId(), userId)) {

Source: GitHub Commit de89b8d. The patch adds an ownership check before the existing role check, ensuring the userId resolves within the requested realm.

Detection Methods for CVE-2026-54641

Indicators of Compromise

API requests to /user/{realm}/users/{userId}, /user/{realm}/userClientRoles/{userId}, or /user/{realm}/userRealmRoles/{userId} where the userId does not resolve to an account in the specified realm.
Repeated 200-OK responses to user lookup endpoints following enumeration-style request patterns from a single administrator session.
Access log entries showing a realm administrator session retrieving user records that correlate with master-realm UUIDs.

Detection Strategies

Correlate OpenRemote Manager access logs with the Keycloak user-to-realm mapping and alert on mismatches between the realm path parameter and the actual owning realm of the returned userId.
Instrument the UserResourceImpl endpoints with request/response logging and flag calls where the response payload contains a realmId different from the authenticated session's realm.
Review audit trails for use of the read:admin role across endpoints that return user profile or role data.

Monitoring Recommendations

Forward OpenRemote Manager and Keycloak audit logs to a centralized analytics platform and build detections for cross-realm user access patterns.
Baseline normal administrator query volume against the user resource and alert on sudden enumeration spikes.
Monitor for lateral movement attempts where cross-tenant information is followed by authentication attempts against the master realm.

How to Mitigate CVE-2026-54641

Immediate Actions Required

Upgrade OpenRemote to version 1.24.2 or later, which contains the throwIfCannotReadUserInRealm check.
Audit all accounts currently holding the read:admin client role and remove the role from accounts that do not require it.
Review recent user-resource API access logs for cross-realm lookups and treat any confirmed cross-tenant reads as an exposure incident.

Patch Information

The fix is included in OpenRemote 1.24.2. See the GitHub Security Advisory GHSA-xqr9-4wvv-gvch and the corrective GitHub Commit de89b8d. The patch adds an authorization check that validates the target user belongs to the requested realm before returning profile or role data.

Workarounds

Restrict network access to the OpenRemote Manager API so that only trusted administrators can reach the user resource endpoints.
Reduce the number of accounts assigned the read:admin client role until the upgrade can be scheduled.
Place a reverse proxy or API gateway in front of OpenRemote and block requests to /user/{realm}/users/*, /user/{realm}/userClientRoles/*, and /user/{realm}/userRealmRoles/* from non-administrative sources.

bash

# Upgrade OpenRemote Manager to the patched release
docker pull openremote/manager:1.24.2
docker stop openremote-manager && docker rm openremote-manager
docker run -d --name openremote-manager \
  --env-file /etc/openremote/manager.env \
  openremote/manager:1.24.2