CVE-2026-126769

OpsTree REMS auth bypass in Governance API exposes database logins

high · 8.7

OpsTree REMS

Published Nov 11, 2026, 18:11 UTC

Description

OpsTree REMS through 1.0.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access Governance API endpoints, including /api/v1/databases. Attackers can send requests without an Authorization header, or with invalid or tampered JWT tokens, to retrieve stored database hosts, usernames, and passwords.

Official CVE record Read Eden case study View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.