Medium severity4.3NVD Advisory· Published Sep 11, 2026· Updated Sep 14, 2026

CVE-2026-49439

Description

OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only read:assets privileges to write predicted datapoints. Version 1.24.1 fixes the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
io.openremote:openremote-managerMaven	< 1.24.1	1.24.1

Affected products

Openremote/Openremotellm-fuzzy
Range: <1.24.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-xj53-j257-hxvgghsaADVISORY
github.com/openremote/openremote/commit/583dbbfb96076ba099be8729ddf506acf9e48325nvdWEB
github.com/openremote/openremote/security/advisories/GHSA-xj53-j257-hxvgnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000