Skip to content

OpenRemote

v1.24.2 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo Dashboards & Home Pages
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

asset-management building web dataplatform device-management edge-computing
+14 more
energy energy-management energy-monitor fleet-management fleet-telematics iot iot-application iot-platform modbus mqtt mqtt-broker ota-update rules-engine smartcity

Affected surfaces

auth deps

ReleasePort's take

Moderate signal
editorial:auto 1mo

The release patches two critical security issues: a cross‑realm user information disclosure in `UserResourceImpl.java` and an XXE vulnerability enabling arbitrary file reads via `XMLInputFactory.java` in `KNXProtocol.startAssetImport()`.

Why it matters: Severity scores of 95 and 98 indicate high‑impact risks; operators should apply the release immediately to prevent information leakage and unauthorized file access.

Summary

AI summary

Updates Other changes, ⭐ Enhancements, and 🔒 Security updates across a mixed release.

Changes in this release

Security Critical

Fixes Cross-Realm User Information Disclosure in `UserResourceImpl.java`

Fixes Cross-Realm User Information Disclosure in `UserResourceImpl.java`

Source: llm_adapter@2026-06-11

Confidence: high

 —
Security Critical

Fixes XXE vulnerability allowing arbitrary file read via `XMLInputFactory.java` in `KNXProtocol.startAssetImport()`

Fixes XXE vulnerability allowing arbitrary file read via `XMLInputFactory.java` in `KNXProtocol.startAssetImport()`

Source: llm_adapter@2026-06-11

Confidence: high

 —
Dependency Low

Upgrades org.checkerframework:checker-qual to latest version

Upgrades org.checkerframework:checker-qual to latest version

Source: llm_adapter@2026-06-11

Confidence: high

 —
Dependency Low

Upgrades Gradle to 9.5.1

Upgrades Gradle to 9.5.1

Source: llm_adapter@2026-06-11

Confidence: high

 —
Dependency Low

Updates NPM dependencies to minor versions

Updates NPM dependencies to minor versions

Source: llm_adapter@2026-06-11

Confidence: high

 —
Bugfix Low

Aligns skip conditions with branch protection checks in CI workflows

Aligns skip conditions with branch protection checks in CI workflows

Source: llm_adapter@2026-06-11

Confidence: high

 —
Bugfix Low

Excludes UI from backend detect‑changes pattern

Excludes UI from backend detect‑changes pattern

Source: llm_adapter@2026-06-11

Confidence: high

 —
Bugfix Low

Cancels deployment job when the run is cancelled

Cancels deployment job when the run is cancelled

Source: llm_adapter@2026-06-11

Confidence: high

 —
Refactor Low

Introduces reusable CI/CD workflows

Introduces reusable CI/CD workflows

Source: llm_adapter@2026-06-11

Confidence: high

 —
Refactor Low

Uses Gradle version catalog instead of custom properties for dependency versions

Uses Gradle version catalog instead of custom properties for dependency versions

Source: llm_adapter@2026-06-11

Confidence: high

 —
Full changelog

What's Changed

🔒 Security updates

  • (CVE pending) on Cross-Realm User Information Disclosure in UserResourceImpl.java
  • (CVE pending) on XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory.java

⭐ Enhancements

  • Update org.checkerframework:checker-qual version to latest by @ebariaux in https://github.com/openremote/openremote/pull/2807
  • Upgrade to gradle 9.5.1 by @ebariaux in https://github.com/openremote/openremote/pull/2835
  • NPM dependencies minor version updates by @MartinaeyNL in https://github.com/openremote/openremote/pull/2842

Other changes

  • CI/CD: Introduce reusable workflows by @Ekhorn in https://github.com/openremote/openremote/pull/2696
  • Use gradle version catalog instead of custom properties for dependency versions by @ebariaux in https://github.com/openremote/openremote/pull/2814
  • Align skip conditions with branch protection checks by @Ekhorn in https://github.com/openremote/openremote/pull/2820
  • Exclude UI from backend detect changes pattern by @Ekhorn in https://github.com/openremote/openremote/pull/2816
  • Cancel deployment job when cancelled by @Ekhorn in https://github.com/openremote/openremote/pull/2806
  • Make get-version-details depend on install-dist by @Ekhorn in https://github.com/openremote/openremote/pull/2823
  • Fix publish jobs and ci_cd.json processing by @Ekhorn in https://github.com/openremote/openremote/pull/2804
  • Include package.json files in UI artifacts by @Ekhorn in https://github.com/openremote/openremote/pull/2828
  • Create missing openremote/util artifact by @Ekhorn in https://github.com/openremote/openremote/pull/2830
  • Align skip conditions for other env workflows with review by @Ekhorn in https://github.com/openremote/openremote/pull/2831

Full Changelog: https://github.com/openremote/openremote/compare/1.24.1...1.24.2

Security Fixes

  • CVE pending – Cross‑Realm User Information Disclosure in `UserResourceImpl.java`
  • CVE pending – XXE vulnerability in `KNXProtocol.startAssetImport()` allowing arbitrary file read via unprotected `XMLInputFactory.java`
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track OpenRemote

Get notified when new releases ship.

Sign up free

About OpenRemote

IoT Asset management, Flow Rules and WHEN-THEN rules, Data visualization, Edge Gateway.

All releases →

Related context

Earlier breaking changes

  • v1.24.0 Requires PostgreSQL versions 15.14+ or 17.9+; older versions will fail to boot.
  • v1.24.0 PostgreSQL TimescaleDB now uses HyperCore compression by default.
  • v1.24.0 Upgraded to Groovy version 5.0, impacting Groovy rules and tests.
  • v1.24.0 Replace obsolete Keycloak adapter with Nimbus based JWT token verifier.

Beta — feedback welcome: [email protected]