Skip to content
Threat Feed
Subscribe
high advisory

OpsTree REMS: Authentication bypass in Governance API (CVE-2026-126769)

OpsTree REMS through version 1.0.0 is susceptible to an authentication bypass vulnerability allowing unauthenticated remote attackers to query sensitive Governance API endpoints.

CVE search metadata

CVE search record: CVE-2026-126769. Severity: high. CVSS: 7.5. KEV: no. Product: REMS (through 1.0.0). Brief: OpsTree REMS: Authentication bypass in Governance API (CVE-2026-126769). Brief link: https://feed.craftedsignal.io/briefs/2026-11-opstree-rems-auth-bypass-cve-2026-126769/

Triage facts

Revision 1
Applicability
REMS (through 1.0.0)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 11, 20:05 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

OpsTree REMS versions through 1.0.0 contain a missing authentication vulnerability that allows unauthenticated remote attackers to access sensitive Governance API endpoints. By sending requests to specific endpoints, such as /api/v1/databases, without an Authorization header or with invalid/tampered JWT tokens, attackers can bypass security controls and retrieve stored database configuration details.

Impact

Successful exploitation allows unauthenticated remote attackers to exfiltrate sensitive information from the application, specifically database host addresses, usernames, and passwords stored within the system. The CVSS v3.1 base score for this vulnerability is 7.5.

Recommendation

  1. Identify all instances of OpsTree REMS version 1.0.0 or earlier within the environment.
  2. Implement network segmentation or access control lists (ACLs) to restrict access to the Governance API endpoints (e.g., /api/v1/databases) to trusted administrative IP addresses until a patch is applied.
  3. Monitor server-side web application logs for HTTP requests to /api/v1/databases that lack valid Authorization headers or contain suspicious/malformed tokens.

Immediate actions

Deploy detection rule for unauthorized access to /api/v1/databases

Detection Engineering 24h

Threat Hunt

Review web application access logs for status code 200 responses to /api/v1/databases where the Authorization header field is missing or null.

T1190 high high confidence hunt now

Data: webserver access logs, HTTP header telemetry

Detection coverage 1

Detect CVE-2026-126769 Exploitation - Unauthenticated Access to Governance API

high

Detects potential exploitation of CVE-2026-126769 by identifying HTTP requests to the /api/v1/databases endpoint that lack an Authorization header or use invalid credentials.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →