OpenRemote XXE Flaw Exposes IoT Platforms to File Disclosure

The National Vulnerability Database has detailed CVE-2026-40882, a critical XML External Entity (XXE) vulnerability in OpenRemote, an open-source Internet of Things (IoT) platform. Prior to version 1.22.0, the Velbus asset import path lacked proper hardening against XXE. This oversight allows an authenticated attacker, capable of invoking the import endpoint, to trigger XML external entity processing.

This vulnerability carries significant risks, including server-side file disclosure and Server-Side Request Forgery (SSRF). Attackers can potentially read sensitive files on the server, albeit limited to files under 1023 characters. The CVSS score of 7.6 (High) underscores the severity, with an attack vector allowing network-based exploitation by low-privileged users, leading to high confidentiality impact and moderate integrity/availability impacts.

Defenders leveraging OpenRemote must prioritize patching to version 1.22.0 immediately. The attacker’s calculus here is straightforward: gain a foothold as an authenticated user, exploit the import function to exfiltrate sensitive configuration files, or pivot to internal systems via SSRF. This is a clear path to further compromise within an IoT infrastructure, which often interfaces with critical operational technology.