CVE-2026-41166 - Vulnerability Analysis

Overview

OpenRemote < 1.22.1 contains a broken access control vulnerability caused by improper authorization checks in Manager API when updating Keycloak realm roles, letting users with write:admin in one realm escalate privileges to master realm administrator, exploit requires attacker to control a user in master realm.

Severity & Score

Impact

Attackers can escalate privileges to master realm administrator, gaining full administrative control over the system.

Mitigation

Update to version 1.22.1 or later.

References

• https://github.com/openremote/openremote/releases/tag/1.22.1
• https://github.com/openremote/openremote/security/advisories/GHSA-49vv-25qx-mg44

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner