CVE-2026-41166: 
Java vulnerability analysis and mitigation

CVE-2026-41166 is an Improper Access Control vulnerability in OpenRemote's Manager API that allows a user with write:admin privileges in one Keycloak realm to escalate privileges by modifying realm roles for users in other realms, including the master realm. It affects OpenRemote versions up to and including 1.22.0 (Maven package io.openremote:openremote-manager), and was patched in version 1.22.1. The vulnerability was published on April 20, 2026, and assigned a CVSS v3.1 base score of 7.0 (High) (GitHub Advisory, OpenRemote Advisory).

The root cause is CWE-284 (Improper Access Control) in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java. The updateUserRealmRoles() method accepts a {realm} path parameter and passes it directly to the identity provider without verifying that the authenticated caller has administrative rights over the specified target realm. An attacker with write:admin in any non-master realm can craft an API request targeting the master realm's user role endpoint, granting the admin realm role to a user they control in master. A complete proof-of-concept curl command is publicly documented in the security advisory (OpenRemote Advisory).

Successful exploitation allows an attacker to grant Keycloak admin realm roles to any user in the master realm, effectively achieving full Keycloak administrator access. This gives the attacker control over all realms, users, clients, and identity provider configurations within the OpenRemote deployment, enabling complete platform takeover, data exfiltration, and potential lateral movement to connected IoT devices and systems managed by the platform (OpenRemote Advisory, GitHub Advisory).

A detailed proof-of-concept exploit, including a runnable curl command, is publicly available in the GitHub security advisory (OpenRemote Advisory). The EPSS score is approximately 0.021% (6th percentile), indicating low but non-zero probability of near-term exploitation. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to already hold write:admin in at least one non-master realm and to know or discover the UUID of a target user in the master realm, which raises the attack complexity (GitHub Advisory).

1. Obtain write:admin access: Gain or create an account with the OpenRemote client role write:admin in any non-master Keycloak realm (referred to as NEW_REALM).
2. Identify a target user in master realm: Using the Keycloak Admin Console or API, enumerate users in the master realm and identify a low-privilege user whose UUID (<master-user-uuid>) will be targeted for privilege escalation.
3. Authenticate and obtain a Bearer token: Authenticate as the write:admin user in NEW_REALM and retrieve a valid Bearer access token (<token>).
4. Send the malicious API request: Execute the following curl command, substituting the placeholders with actual values:

curl -k -X PUT "https://<host>/api/<NEW_REALM>/user/master/userRealmRoles/<master-user-uuid>" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '["admin"]'

5. Verify privilege escalation: Log into the Keycloak Admin Console for the master realm, navigate to the target user's Role Mappings, and confirm the admin realm role has been assigned.
6. Achieve full platform control: Authenticate as the now-elevated user in the master realm to gain Keycloak administrator access across all realms and connected OpenRemote resources (OpenRemote Advisory).

• Network: Unexpected HTTP PUT requests to /api/<realm>/user/master/userRealmRoles/<uuid> originating from users authenticated in non-master realms; API calls where the realm in the URL path differs from the realm in the Bearer token's claims.
• Logs: OpenRemote Manager API access logs showing PUT /api/*/user/master/userRealmRoles/* requests with non-master realm Bearer tokens; Keycloak audit logs recording unexpected admin realm role assignments in the master realm.
• Keycloak Admin Console: Unexpected admin realm role assignments for users in the master realm, particularly for accounts that previously had no elevated privileges; role mapping changes not initiated by known administrators (OpenRemote Advisory).

Upgrade OpenRemote to version 1.22.1 or later, which includes a fix for this vulnerability in UserResourceImpl.java (OpenRemote Release). As an interim measure, audit all realm role assignments in the master realm to identify any unauthorized admin role grants. Additionally, restrict write:admin role assignments to trusted users only, and review API access logs for suspicious cross-realm role update requests. No configuration-only workaround is available; patching is the only definitive remediation (GitHub Advisory).

The vulnerability was reported by security researcher KKC73 and published by OpenRemote maintainer denniskuijs on April 20, 2026. The advisory was reviewed and published to the GitHub Advisory Database on April 22, 2026, and subsequently indexed by Red Hat CVE tracking and ENISA's EUVD. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation (OpenRemote Advisory).