CVE-2026-65009
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Jul 21, 2026
Vendor
unknown
Description
OpenRemote versions before 1.26.2 contain an information disclosure vulnerability in the SyslogResource REST endpoint that fails to filter operational logs by realm. Attackers with the read:rules role can access the GET /api/{realm}/syslog/event endpoint to retrieve operational logs from all tenants, exposing asset IDs, agent connection details, rule names, and protocol errors across the multi-tenant deployment.