CVE-2026-65009: Openremote

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

OpenRemote versions before 1.26.2 contain an information disclosure vulnerability in the SyslogResource REST endpoint that fails to filter operational logs by realm. Attackers with the read:rules role can access the GET /api/{realm}/syslog/event endpoint to retrieve operational logs from all tenants, exposing asset IDs, agent connection details, rule names, and protocol errors across the multi-tenant deployment.

Affected products

• Openremote Openremote: before 1.26.2 (fixed in 1.26.2)

Published 2026-07-21. Last modified 2026-10-08.