CVE-2026-67310 Overview
CVE-2026-67310 is an insecure direct object reference (IDOR) vulnerability in OpenRemote (org.openremote:openremote) versions <= 1.26.2. The flaw resides in the setAssetLinks endpoint of AlarmResourceImpl, where realm access validation checks only a single realm returned by realms.stream().findFirst() on a HashSet. Because HashSet iteration order is non-deterministic, an authenticated attacker can submit alarm-asset links from both their own realm and a victim realm and succeed roughly 50% of the time per request. Successful requests persist cross-tenant links and expose victim asset names through @Formula fields returned by subsequent GET requests. The issue is fixed in version 1.27.0.
Critical Impact
Authenticated tenants can persist cross-tenant asset links and disclose victim asset names, breaking multi-tenant isolation in OpenRemote.
Affected Products
- OpenRemote (org.openremote:openremote) versions <= 1.26.2
- Fixed release: OpenRemote 1.27.0
- Component: AlarmResourceImpl.setAssetLinks endpoint
Discovery Timeline
- 2026-08-01 - CVE-2026-67310 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-67310
Vulnerability Analysis
The vulnerability is a broken access control issue classified under CWE-863: Incorrect Authorization. The setAssetLinks endpoint accepts a collection of alarm-asset links from an authenticated user. Before persisting the links, the handler validates realm access, but it inspects only one realm from the request instead of every realm referenced by the payload.
Because the realms are stored in a HashSet and the authorization check calls realms.stream().findFirst(), the realm that gets validated depends on non-deterministic iteration order. When a request contains links spanning the attacker's realm and a victim realm, the check passes whenever findFirst() happens to return the attacker's own realm. Cross-tenant links are then persisted, and follow-up GET requests on the attacker's alarm return victim asset names through @Formula-annotated fields.
Root Cause
The root cause is an authorization check that assumes the request references a single realm. Applying the tenant boundary to only one element of an unordered set fails to enforce isolation across all objects in the payload. Any object belonging to a realm other than the one selected by findFirst() bypasses the tenant check entirely.
Attack Vector
An authenticated user with access to at least one realm crafts a setAssetLinks request that references their own alarm plus one or more asset identifiers from a victim realm. The request is repeated until the non-deterministic realm check picks the attacker's realm, which the advisory characterizes as roughly a 50% probability per attempt. After the write succeeds, a standard GET on the attacker's alarm returns victim asset names populated by @Formula fields, leaking data across tenants. No user interaction is required and the attack is performed over the network against the OpenRemote API.
No public proof-of-concept exploit code is available. See the GitHub Security Advisory GHSA-q2gm-frx3-2qjr and the VulnCheck Advisory for additional technical context.
Detection Methods for CVE-2026-67310
Indicators of Compromise
- Repeated POST or PUT calls to the setAssetLinks endpoint of AlarmResourceImpl from the same authenticated principal within a short window, consistent with retry-until-success behavior.
- Alarm records that contain asset_id values whose associated assets belong to a different realm than the alarm owner.
- GET responses on alarms that return asset names from realms the requesting user is not authorized to access.
Detection Strategies
- Inspect application logs for setAssetLinks requests whose payloads reference asset identifiers spanning more than one realm.
- Query the alarm-asset link table for rows where the alarm's realm does not match the linked asset's realm.
- Correlate authenticated user identity with target realm on every alarm read to flag cross-realm disclosure.
Monitoring Recommendations
- Enable verbose auditing on AlarmResourceImpl endpoints and forward logs to a centralized SIEM for retention and analysis.
- Alert on high-frequency retries of the same setAssetLinks payload from a single principal, which indicates probabilistic exploitation.
- Track anomalous growth in cross-realm link counts as an integrity metric for multi-tenant isolation.
How to Mitigate CVE-2026-67310
Immediate Actions Required
- Upgrade OpenRemote to version 1.27.0 or later, which contains the fix for the setAssetLinks realm check.
- Audit existing alarm-asset links and remove any rows where the alarm realm does not match the linked asset realm.
- Rotate or restrict API credentials for any tenant that showed retry patterns against setAssetLinks prior to patching.
Patch Information
The vulnerability is fixed in OpenRemote 1.27.0. The patch replaces the single-realm findFirst() check with validation that iterates every realm referenced by the request payload, ensuring the caller has access to each realm before persisting any link. Refer to the GitHub Security Advisory GHSA-q2gm-frx3-2qjr for release notes and commit references.
Workarounds
- Restrict access to the AlarmResourceImpl endpoints through an upstream reverse proxy or API gateway until the upgrade is applied.
- Limit alarm-management roles to trusted users in single-tenant deployments where multi-realm isolation is not required.
- Add a database-level constraint or scheduled job that rejects or removes alarm-asset links whose realms do not match, as a compensating control.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
