PatchTheCVECVE-2026-41166: OpenRemote is an open-source internet-of-things platform
CVE-2026-41166 is a high-severity flaw (CVSS 7.0) affecting openremote. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.1, a user who has `write:admin` in one Keycloak realm can call the Manager API to update Keycloak realm roles for users in another realm, including `master`. The handler uses the `{realm}` path segment when talking to the identity provider but does not check that the caller may administer that realm. This could result in a privilege escalation to `master` realm admini
Why this priority
- High severity
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.0 (High) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 79%) |
| CISA exploited list | No |
| Weakness | CWE-284 |
| Published | 2026-04-22 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-41166?
openremote: upgrade to 1.22.1. Exact commands for each OS are on this page.
Is CVE-2026-41166 being exploited?
CVE-2026-41166 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-41166 affect?
CVE-2026-41166 affects openremote. Severity is high (CVSS 7.0). OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.1, a user who has `write:admin` in one Keycloak realm can call the Manager API to update Keycloak realm roles for users in another realm, including `master`. Th
How urgent is CVE-2026-41166?
Priority 40/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2026-62238 HIGH 8.8 UPGRADE OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export
- CVE-2026-40882 HIGH 7.6 UPGRADE OpenRemote is an open-source internet-of-things platform
- CVE-2026-39842 CRITICAL 9.9 UPGRADE OpenRemote is an open-source IoT platform