This release includes 2 security fixes for security teams reviewing exposed deployments.
Topics
+14 more
Affected surfaces
ReleasePort's take
Moderate signalRelease 1.26.2 patches two critical unauthenticated security issues—a console registration vulnerability enabling asset takeover and a syslog REST API information‑disclosure flaw—and adds several operational improvements.
Why it matters: Severity 90 fixes block unauthenticated asset takeover and cross‑realm data leaks; operators must upgrade immediately to protect exposed surfaces.
Summary
AI summaryUpdates Other changes, ⭐ Enhancements, and 🐞 Bug fixes across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Fixes unauthenticated console registration allowing asset takeover. Fixes unauthenticated console registration allowing asset takeover. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Security | Critical |
Fixes cross‑realm information disclosure via unfiltered syslog REST API. Fixes cross‑realm information disclosure via unfiltered syslog REST API. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds flag to disable Groovy rules compilation/execution. Adds flag to disable Groovy rules compilation/execution. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Improves container lifecycle management and cleanup logic. Improves container lifecycle management and cleanup logic. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds or‑vaadin toggle implementation. Adds or‑vaadin toggle implementation. Source: llm_adapter@2026-07-15 Confidence: low |
— |
| Feature | Low |
Implements or‑vaadin toggle component. Implements or‑vaadin toggle component. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Dependency | Low |
Bumps org.apache.sshd:sshd-netty from 2.16.0 to 2.18.0. Bumps org.apache.sshd:sshd-netty from 2.16.0 to 2.18.0. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Dependency | Low |
Upgrades Swagger UI to version 5.32.8. Upgrades Swagger UI to version 5.32.8. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Dependency | Low |
Bumps org.postgresql:postgresql from 42.7.11 to 42.7.13. Bumps org.postgresql:postgresql from 42.7.11 to 42.7.13. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Fixes handling of non‑existent/invalid directories when listing installed apps. Fixes handling of non‑existent/invalid directories when listing installed apps. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Adds missing MASTER realm check to TokenVerifierImpl for correct super‑user filtering. Adds missing MASTER realm check to TokenVerifierImpl for correct super‑user filtering. Source: llm_adapter@2026-07-15 Confidence: low |
— |
Full changelog
What's Changed
🔒 Security updates
- (CVE pending) on Unauthenticated Console Registration Allows Existing Console Asset Takeover
- (CVE pending) on Cross-realm information disclosure via unfiltered syslog REST API exposes all tenants' operational logs
⭐ Enhancements
- Add flag to disable groovy rules compilation/execution by @ebariaux in https://github.com/openremote/openremote/pull/3001
- Implement or-vaadin-toggle by @Ekhorn in https://github.com/openremote/openremote/pull/2981
- Improve container lifecycle management and cleanup logic by @richturner in https://github.com/openremote/openremote/pull/2996
🐞 Bug fixes
- Handle non existent / invalid directories when listing installed apps by @ebariaux in https://github.com/openremote/openremote/pull/2979
- Add missing MASTER realm check to TokenVerifierImpl to ensure correct super user filtering at the token verficiation level by @richturner in https://github.com/openremote/openremote/pull/2994
- Remove dependency on admin credentials from AddServiceRoles migration by @Ekhorn in https://github.com/openremote/openremote/pull/2976
Other changes
- Bump org.apache.sshd:sshd-netty from 2.16.0 to 2.18.0 by @dependabot[bot] in https://github.com/openremote/openremote/pull/2853
- Bump docker/build-push-action from 7.2.0 to 7.3.0 by @dependabot[bot] in https://github.com/openremote/openremote/pull/2977
- Bump swagger from 2.2.49 to 2.2.52 by @dependabot[bot] in https://github.com/openremote/openremote/pull/2951
- Upgrade Swagger UI to 5.32.8 by @wborn in https://github.com/openremote/openremote/pull/2983
- Bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in https://github.com/openremote/openremote/pull/2987
- Bump docker/login-action from 4.2.0 to 4.3.0 by @dependabot[bot] in https://github.com/openremote/openremote/pull/2985
- Bump com.hivemq:hivemq-mqtt-client from 1.3.15 to 1.3.16 by @dependabot[bot] in https://github.com/openremote/openremote/pull/2988
- Bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3 by @dependabot[bot] in https://github.com/openremote/openremote/pull/2986
- SyslogResourceTest cleanup created user by @richturner in https://github.com/openremote/openremote/pull/2995
- Bump docker/login-action from 4.3.0 to 4.4.0 by @dependabot[bot] in https://github.com/openremote/openremote/pull/2990
- Upgrade Storybook to 10.4.6 by @MartinaeyNL in https://github.com/openremote/openremote/pull/2997
- Bump aws-actions/configure-aws-credentials from 6.2.1 to 6.2.2 by @dependabot[bot] in https://github.com/openremote/openremote/pull/3000
- Bump actions/setup-java from 5.4.0 to 5.5.0 by @dependabot[bot] in https://github.com/openremote/openremote/pull/2999
- Bump echarts from 6.0.0 to 6.1.0 by @dependabot[bot] in https://github.com/openremote/openremote/pull/2973
- Bump minor UI dependencies by @MartinaeyNL in https://github.com/openremote/openremote/pull/3003
- Bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 by @dependabot[bot] in https://github.com/openremote/openremote/pull/3005
- Fix flaky geocoder UI app test by @Ekhorn in https://github.com/openremote/openremote/pull/3004
- Bump org.hibernate.validator:hibernate-validator from 9.1.0.Final to 9.1.2.Final by @dependabot[bot] in https://github.com/openremote/openremote/pull/2989
- Update typescript generator version by @ebariaux in https://github.com/openremote/openremote/pull/3006
- Bump artemis from 2.54.0 to 2.55.0 by @dependabot[bot] in https://github.com/openremote/openremote/pull/2968
- Bump com.nimbusds:nimbus-jose-jwt from 10.4.2 to 10.9.1 by @dependabot[bot] in https://github.com/openremote/openremote/pull/2967
- Bump org.ow2.asm:asm-tree from 9.5 to 9.10.1 by @dependabot[bot] in https://github.com/openremote/openremote/pull/2991
- Bump org.postgresql:postgresql from 42.7.11 to 42.7.13 by @dependabot[bot] in https://github.com/openremote/openremote/pull/3016
- Bump webpack from 5.105.4 to 5.108.3 by @dependabot[bot] in https://github.com/openremote/openremote/pull/2941
- Bump cross-env from 7.0.3 to 10.1.0 by @dependabot[bot] in https://github.com/openremote/openremote/pull/2928
- Only apply delay when enabling providers by @Ekhorn in https://github.com/openremote/openremote/pull/3018
- Bump @wc-toolkit/storybook-helpers from 10.4.0 to 10.5.1 by @dependabot[bot] in https://github.com/openremote/openremote/pull/3024
- Bump the vaadin group with 22 updates by @dependabot[bot] in https://github.com/openremote/openremote/pull/3023
- Bump com.icegreen:greenmail from 2.1.2 to 2.1.9 by @dependabot[bot] in https://github.com/openremote/openremote/pull/3013
- Bump org.mnode.ical4j:ical4j from 4.2.5 to 4.3.0 by @dependabot[bot] in https://github.com/openremote/openremote/pull/3015
- Bump org.slf4j:slf4j-jdk14 from 2.0.17 to 2.0.18 by @dependabot[bot] in https://github.com/openremote/openremote/pull/3022
- Bump org.checkerframework:checker-qual from 3.55.1 to 4.2.1 by @dependabot[bot] in https://github.com/openremote/openremote/pull/3014
- Bump grpc from 1.82.0 to 1.82.2 by @dependabot[bot] in https://github.com/openremote/openremote/pull/3032
Full Changelog: https://github.com/openremote/openremote/compare/1.26.1...1.26.2
Security Fixes
- (CVE pending) on Unauthenticated Console Registration Allows Existing Console Asset Takeover
- (CVE pending) on Cross-realm information disclosure via unfiltered syslog REST API exposes all tenants' operational logs
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About OpenRemote
IoT Asset management, Flow Rules and WHEN-THEN rules, Data visualization, Edge Gateway.
Related context
Related tools
Earlier breaking changes
- v1.24.0 Requires PostgreSQL versions 15.14+ or 17.9+; older versions will fail to boot.
- v1.24.0 PostgreSQL TimescaleDB now uses HyperCore compression by default.
- v1.24.0 Upgraded to Groovy version 5.0, impacting Groovy rules and tests.
- v1.24.0 Replace obsolete Keycloak adapter with Nimbus based JWT token verifier.
Beta — feedback welcome: [email protected]