OpenRemote before 1.32.2 Improper Authorization Allows Realm Admins to Modify Global Resources
Affects OpenRemote core before 1.32.2, where a realm admin in a realm other than master can change global resources. The fix is in 1.32.2.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 1.32.2
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. OpenRemote versions before 1.32.2 (affected core versions below 1.32.2) Attacker holds a realm administrator role (read:admin or write:admin) in a realm other than master
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 17/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
OpenRemote, before the fixed release, lets a realm administrator reach global admin endpoints that lack super administrator checks, so they can change global resources such as the keycloakUrl that controls console sign-in for other realms, enabling credential phishing, CSS injection, map tile replacement, and log deletion. The flaw is reached remotely by an account holder with low privileges, and it requires a user to take an action.
Read the original description
OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resources by calling admin endpoints lacking super administrator checks. Attackers can change the global keycloakUrl via /configuration/manager to redirect other realms' console authentication for credential phishing, inject CSS, replace map tiles, and delete logs.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.6/10CVSS 8.6
- No patch0/5No signal
What would change the score
- Would score about 67 if added to CISA KEV
- Would score about 62 if CISA's SSVC rates exploitation active
- Would score about 24 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
OpenRemote versions before 1.32.2 (affected core versions below 1.32.2) Attacker holds a realm administrator role (read:admin or write:admin) in a realm other than masterUpgrade to a fixed version: 1.32.2.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- openremote core
fixed in 1.32.2
Evidence 2
- Advisory
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-124436
Is CVE-2026-124436 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
A realm administrator in a realm other than master can change the global keycloakUrl through the /configuration/manager endpoint. That change can redirect other realms' console authentication, which the advisory says enables credential phishing. The same access can inject CSS, replace map tiles, and delete logs.Source: vulncheck.com, github.com
Which versions are affected by CVE-2026-124436?
core: before 1.32.2.Source: cve.now feed data
Am I affected, and how do I check?
Core versions before 1.32.2 are affected. The attacker must hold the read:admin or write:admin role in a realm other than master. To check a deployment, compare its installed core version with 1.32.2.Source: vulncheck.com, github.com
How do I fix CVE-2026-124436?
Upgrade OpenRemote core to 1.32.2 or later, which is the listed fixed version. No workaround is listed in the facts.Source: vulncheck.com, github.com