CVE-2026-65009 - OpenRemote before 1.26.2 Information Disclosure via Syslog REST API

Back Back to CVE browser

MEDIUM

OpenRemote before 1.26.2 Information Disclosure via Syslog REST API

Published Jul 21, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.31%

Description

OpenRemote versions before 1.26.2 contain an information disclosure vulnerability in the SyslogResource REST endpoint that fails to filter operational logs by realm. Attackers with the read:rules role can access the GET /api/{realm}/syslog/event endpoint to retrieve operational logs from all tenants, exposing asset IDs, agent connection details, rule names, and protocol errors across the multi-tenant deployment.

Affected products

Vendor Openremote Product Openremote Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <1.26.2
- Version
  1.26.2
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Openremote

unaffected

Version	Status	Constraints
0	affected	<1.26.2
1.26.2	unaffected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-46184
Advisory
https://github.com/openremote/openremote/security/advisories/GHSA-fv8q-rwj8-2c55
exploitvendor-advisory
https://www.vulncheck.com/advisories/openremote-before-information-disclosure-via-syslog-rest-api
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-46184		Advisory
https://github.com/openremote/openremote/security/advisories/GHSA-fv8q-rwj8-2c55		exploitvendor-advisory
https://www.vulncheck.com/advisories/openremote-before-information-disclosure-via-syslog-rest-api		third-party-advisory