OpenRemote Privilege Escalation: Master Realm at Risk

The National Vulnerability Database has detailed CVE-2026-41166, a critical privilege escalation vulnerability in OpenRemote, an open-source IoT platform. Prior to version 1.22.1, a user with write:admin permissions in any Keycloak realm could exploit a flaw in the Manager API. This allowed them to modify Keycloak realm roles for users in other realms, including the master realm.

The core issue, as described by the National Vulnerability Database, is that the API handler uses the realm path segment when communicating with the identity provider but fails to verify if the calling user has administrative privileges for that specific realm. This oversight creates a direct path for an attacker, who controls any user in the master realm, to escalate privileges to a master realm administrator.

This is a severe design flaw (CVSS score 7, CWE-284) that directly impacts the integrity of access controls. Defenders must prioritize patching OpenRemote to version 1.22.1 immediately to mitigate this risk. An attacker gaining master realm administrator access means total compromise of the identity provider, leading to widespread system control.