CVE-2026-65009 — OpenRemote before 1.26.2 Information Disclosure via Syslog REST API
OpenRemote versions before 1.26.2 contain an information disclosure vulnerability in the SyslogResource REST endpoint that fails to filter operational logs by realm. Attackers w…
Published: 2026-07-21 · CVSS: 5.3 · CVSS 4.0
OpenRemote versions before 1.26.2 contain an information disclosure vulnerability in the SyslogResource REST endpoint that fails to filter operational logs by realm. Attackers with the read:rules role can access the GET /api/{realm}/syslog/event endpoint to retrieve operational logs from all tenants, exposing asset IDs, agent connection details, rule names, and protocol errors across the multi-tenant deployment.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7