OpsTree - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/opstree/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 20:05:04 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOpsTree REMS: Authentication bypass in Governance API (CVE-2026-126769)https://feed.craftedsignal.io/briefs/2026-11-opstree-rems-auth-bypass-cve-2026-126769/Wed, 11 Nov 2026 20:05:04 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-opstree-rems-auth-bypass-cve-2026-126769/OpsTree REMS through version 1.0.0 is susceptible to an authentication bypass vulnerability allowing unauthenticated remote attackers to query sensitive Governance API endpoints.OpsTree REMS versions through 1.0.0 contain a missing authentication vulnerability that allows unauthenticated remote attackers to access sensitive Governance API endpoints. By sending requests to specific endpoints, such as /api/v1/databases, without an Authorization header or with invalid/tampered JWT tokens, attackers can bypass security controls and retrieve stored database configuration details.

Impact

Successful exploitation allows unauthenticated remote attackers to exfiltrate sensitive information from the application, specifically database host addresses, usernames, and passwords stored within the system. The CVSS v3.1 base score for this vulnerability is 7.5.

Recommendation

  1. Identify all instances of OpsTree REMS version 1.0.0 or earlier within the environment.
  2. Implement network segmentation or access control lists (ACLs) to restrict access to the Governance API endpoints (e.g., /api/v1/databases) to trusted administrative IP addresses until a patch is applied.
  3. Monitor server-side web application logs for HTTP requests to /api/v1/databases that lack valid Authorization headers or contain suspicious/malformed tokens.
]]>highadvisoryOpsTree REMS: Authentication bypass vulnerability (CVE-2026-126768)https://feed.craftedsignal.io/briefs/2026-11-opstree-rems-auth-bypass-cve-2026-126768/Wed, 11 Nov 2026 20:04:08 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-opstree-rems-auth-bypass-cve-2026-126768/OpsTree REMS through version 1.0.0 contains an authentication bypass vulnerability allowing unauthenticated attackers to obtain valid JWTs and gain administrative access via parameter manipulation.OpsTree REMS through version 1.0.0 contains an authentication bypass vulnerability. Attackers can send a POST /api/v1/user/login/ request for the admin account with an invalid password and the is_local_auth field set to true to bypass authentication.

Impact

Successful exploitation allows an unauthenticated attacker to obtain a valid JWT for an administrative account, resulting in SuperUser administrative access.

Recommendation

Monitor logs for the POST /api/v1/user/login/ request pattern where the client-controlled is_local_auth field is set to true.

]]>criticaladvisory