CVE-2026-65009: OpenRemote Information Disclosure Flaw

CVE-2026-65009 Overview

CVE-2026-65009 is an information disclosure vulnerability in OpenRemote versions before 1.26.2. The SyslogResource REST endpoint fails to filter operational logs by realm in the multi-tenant deployment. Attackers holding the read:rules role can query GET /api/{realm}/syslog/event and retrieve logs belonging to every tenant on the platform. Exposed data includes asset IDs, agent connection details, rule names, and protocol errors. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Authenticated users with read:rules privileges in one realm can enumerate operational log data across all realms, breaking tenant isolation in OpenRemote deployments.

Affected Products

OpenRemote versions prior to 1.26.2
Multi-tenant OpenRemote deployments exposing the REST API
Any OpenRemote realm that grants the read:rules role to end users

Discovery Timeline

2026-07-21 - CVE-2026-65009 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-65009

Vulnerability Analysis

OpenRemote uses a realm-based multi-tenant model. Each realm should only see its own assets, rules, and operational events. The SyslogResource REST endpoint returns operational log entries produced by the OpenRemote runtime, including protocol adapters, agents, and rule engines. In versions before 1.26.2, this endpoint does not apply a realm filter to the underlying log query. Any authenticated caller with the read:rules role in any realm receives the global log stream.

The leaked data supports reconnaissance against other tenants sharing the deployment. Asset IDs allow targeted follow-up queries. Agent connection details reveal deployed protocols and endpoints. Rule names disclose automation logic, and protocol error messages can expose device addresses, credentials embedded in log strings, and integration internals.

Root Cause

The root cause is a missing authorization check on the syslog query. The endpoint validates that the caller has the read:rules role but does not scope the query to the caller's realm. The path parameter {realm} is accepted but not enforced against the returned rows, so the server returns cross-realm data regardless of the value supplied.

Attack Vector

An attacker first obtains an account in any tenant of the target OpenRemote instance with the read:rules role. This role is commonly granted to rule authors and integrators. The attacker then issues an authenticated GET request to /api/{realm}/syslog/event and parses the response for entries whose realm identifier differs from the caller's realm. No user interaction, elevated privileges, or additional exploitation steps are required. See the OpenRemote GHSA-fv8q-rwj8-2c55 advisory and the VulnCheck advisory for additional detail.

Detection Methods for CVE-2026-65009

Indicators of Compromise

Authenticated GET requests to /api/{realm}/syslog/event from user accounts that do not normally query syslog data
Log responses containing asset IDs, agent names, or rule names that belong to realms other than the requesting user's realm
Bursts of syslog endpoint queries from a single account followed by lateral queries against enumerated asset IDs

Detection Strategies

Enable HTTP access logging on the OpenRemote reverse proxy and alert on any request to /syslog/event outside expected administrator sessions
Correlate the authenticated user's realm claim in the JWT with the {realm} path parameter and flag mismatches
Baseline normal read:rules API usage per account and alert on volume anomalies against the syslog endpoint

Monitoring Recommendations

Audit the list of accounts holding the read:rules role across every realm and remove unnecessary grants
Forward OpenRemote application and access logs to a central log platform for retention and cross-realm correlation
Review historical logs for /syslog/event calls dating back to the deployment of any pre-1.26.2 version

How to Mitigate CVE-2026-65009

Immediate Actions Required

Upgrade OpenRemote to version 1.26.2 or later on every node in the deployment
Rotate any credentials, tokens, or device secrets that may have appeared in operational log strings
Review read:rules role assignments and revoke the role from accounts that do not author automation logic

Patch Information

OpenRemote resolved the issue in version 1.26.2 by enforcing realm scoping on the SyslogResource endpoint. Consult the GitHub Security Advisory GHSA-fv8q-rwj8-2c55 for the fix commit and upgrade instructions.

Workarounds

Block external access to /api/*/syslog/event at the reverse proxy until the upgrade is applied
Remove the read:rules role from non-administrative accounts to reduce the exposed population
Restrict management API access to a trusted network segment or VPN

bash

# Example NGINX rule to block the syslog endpoint until patched
location ~* ^/api/[^/]+/syslog/event { 
    return 403; 
}