CVE-2026-116184: core 0 to before 1.31.0

Affected technology

core · 0 to before 1.31.0
openremote

Description’s affected range: before 1.31.0

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · High privileges required · No user interaction required

What an attacker can do

Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network. Vendor/CNA’s CVSS 4.0 assessment (base score 2.1/10) rates confidentiality, integrity and availability impact as low.