GHSA-rxpf-ghf8-22v2HighCVSS 7.5
OpsTree REMS through 1.0.0 contains a missing authentication vulnerability that allows...
🔗 CVE IDs covered (1)
📋 Description
OpsTree REMS through 1.0.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access Governance API endpoints, including /api/v1/databases. Attackers can send requests without an Authorization header, or with invalid or tampered JWT tokens, to retrieve stored database hosts, usernames, and passwords.
🔗 References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2026-126769
- https://gist.github.com/neelkotnis/3fc4a8587179a8691ed89056ea7df076
- https://gist.github.com/neelkotnis/493d542098b328570f821dc152146732
- https://opstree.com/rems-ai-powered-observability
- https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-missing-authentication-via-api-v1-databases-governance-api
- https://github.com/advisories/GHSA-rxpf-ghf8-22v2