CVE-2026-126770
MEDIUM
NVD
CVSS Score
5
Severity
MEDIUM
Published
Nov 11, 2026
Vendor
unknown
Description
OpsTree REMS through 1.0.0 contains a server-side request forgery vulnerability that allows authenticated users to make the backend connect to arbitrary destinations through the database Test Connection feature. Attackers can set a database entry's host and port to localhost, internal addresses, or attacker-controlled servers to probe internal hosts and ports reachable from the REMS server.