CVE-2026-126769

Description

OpsTree REMS through 1.0.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access Governance API endpoints, including /api/v1/databases. Attackers can send requests without an Authorization header, or with invalid or tampered JWT tokens, to retrieve stored database hosts, usernames, and passwords.

References

• https://gist.github.com/neelkotnis/3fc4a8587179a8691ed89056ea7df076
• https://gist.github.com/neelkotnis/493d542098b328570f821dc152146732
• https://opstree.com/rems-ai-powered-observability/
• https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-missing-authentication-via-api-v1-databases-governance-api