Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-126772 (GCVE-0-2026-126772)

Vulnerability from nvd – Published: 2026-11-11 18:11 – Updated: 2026-11-11 18:11

Title

OpsTree REMS through 1.0.0 Comment Author Spoofing via Incident Comment API

Summary

OpsTree REMS through 1.0.0 contains an improper attribution vulnerability that allows authenticated users to post comments as the incident creator via POST /api/v1/incidents/{incident_id}/comment. Lower-privileged attackers can comment on incidents owned by users such as a Super User to impersonate them and corrupt the incident timeline and audit trail.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7828 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/5a5c810e16a3f2…	technical-descriptionexploit
https://opstree.com/rems-ai-powered-observability/	product
https://www.vulncheck.com/advisories/opstree-rems…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	REMS	Affected: 0 , ≤ 1.0.0 (custom)

Date Public

2026-09-20 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "REMS",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThanOrEqual": "1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-09-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree REMS through 1.0.0 contains an improper attribution vulnerability that allows authenticated users to post comments as the incident creator via POST /api/v1/incidents/{incident_id}/comment. Lower-privileged attackers can comment on incidents owned by users such as a Super User to impersonate them and corrupt the incident timeline and audit trail."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T18:11:17.898Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/5a5c810e16a3f242f336198b32213629"
        },
        {
          "name": "REMS by OpsTree Product Page",
          "tags": [
            "product"
          ],
          "url": "https://opstree.com/rems-ai-powered-observability/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree REMS through 1.0.0 Comment Author Spoofing via Incident Comment API",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-comment-author-spoofing-via-incident-comment-api"
        }
      ],
      "title": "OpsTree REMS through 1.0.0 Comment Author Spoofing via Incident Comment API",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-126772",
    "datePublished": "2026-11-11T18:11:17.898Z",
    "dateReserved": "2026-11-11T18:05:56.862Z",
    "dateUpdated": "2026-11-11T18:11:17.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126771 (GCVE-0-2026-126771)

Vulnerability from nvd – Published: 2026-11-11 18:11 – Updated: 2026-11-11 18:11

Title

OpsTree REMS through 1.0.0 Stored XSS via Attachment Upload and Preview

Summary

OpsTree REMS through 1.0.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts by uploading attachments with spoofed text/html Content-Type. Attackers can upload HTML files named like test.html.pdf that render in the REMS origin via Preview, executing JavaScript in victims' browsers.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7828 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/ddf75e2cb71921…	technical-descriptionexploit
https://opstree.com/rems-ai-powered-observability/	product
https://www.vulncheck.com/advisories/opstree-rems…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	REMS	Affected: 0 , ≤ 1.0.0 (custom)

Date Public

2026-09-20 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "REMS",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThanOrEqual": "1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-09-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree REMS through 1.0.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts by uploading attachments with spoofed text/html Content-Type. Attackers can upload HTML files named like test.html.pdf that render in the REMS origin via Preview, executing JavaScript in victims\u0027 browsers."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T18:11:17.246Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/ddf75e2cb7192180e6c9618d27d1e99b"
        },
        {
          "name": "REMS by OpsTree Product Page",
          "tags": [
            "product"
          ],
          "url": "https://opstree.com/rems-ai-powered-observability/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree REMS through 1.0.0 Stored XSS via Attachment Upload and Preview",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-stored-xss-via-attachment-upload-and-preview"
        }
      ],
      "title": "OpsTree REMS through 1.0.0 Stored XSS via Attachment Upload and Preview",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-126771",
    "datePublished": "2026-11-11T18:11:17.246Z",
    "dateReserved": "2026-11-11T18:05:56.522Z",
    "dateUpdated": "2026-11-11T18:11:17.246Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126770 (GCVE-0-2026-126770)

Vulnerability from nvd – Published: 2026-11-11 18:11 – Updated: 2026-11-11 18:11

Title

OpsTree REMS through 1.0.0 SSRF via Database Test Connection

Summary

OpsTree REMS through 1.0.0 contains a server-side request forgery vulnerability that allows authenticated users to make the backend connect to arbitrary destinations through the database Test Connection feature. Attackers can set a database entry's host and port to localhost, internal addresses, or attacker-controlled servers to probe internal hosts and ports reachable from the REMS server.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7828 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/3c4a44d71e8f08…	technical-descriptionexploit
https://opstree.com/rems-ai-powered-observability/	product
https://www.vulncheck.com/advisories/opstree-rems…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	REMS	Affected: 0 , ≤ 1.0.0 (custom)

Date Public

2026-09-20 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "REMS",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThanOrEqual": "1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-09-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree REMS through 1.0.0 contains a server-side request forgery vulnerability that allows authenticated users to make the backend connect to arbitrary destinations through the database Test Connection feature. Attackers can set a database entry\u0027s host and port to localhost, internal addresses, or attacker-controlled servers to probe internal hosts and ports reachable from the REMS server."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T18:11:16.626Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/3c4a44d71e8f08747fbac13b2be87427"
        },
        {
          "name": "REMS by OpsTree Product Page",
          "tags": [
            "product"
          ],
          "url": "https://opstree.com/rems-ai-powered-observability/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree REMS through 1.0.0 SSRF via Database Test Connection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-ssrf-via-database-test-connection"
        }
      ],
      "title": "OpsTree REMS through 1.0.0 SSRF via Database Test Connection",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-126770",
    "datePublished": "2026-11-11T18:11:16.626Z",
    "dateReserved": "2026-11-11T18:05:56.194Z",
    "dateUpdated": "2026-11-11T18:11:16.626Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126769 (GCVE-0-2026-126769)

Vulnerability from nvd – Published: 2026-11-11 18:11 – Updated: 2026-11-11 18:11

Title

OpsTree REMS through 1.0.0 Missing Authentication via /api/v1/databases Governance API

Summary

OpsTree REMS through 1.0.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access Governance API endpoints, including /api/v1/databases. Attackers can send requests without an Authorization header, or with invalid or tampered JWT tokens, to retrieve stored database hosts, usernames, and passwords.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7828 records in the last 180 days details

References

4 references

URL	Tags
https://gist.github.com/neelkotnis/493d542098b328…	technical-descriptionexploit
https://gist.github.com/neelkotnis/3fc4a8587179a8…	technical-description
https://opstree.com/rems-ai-powered-observability/	product
https://www.vulncheck.com/advisories/opstree-rems…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	REMS	Affected: 0 , ≤ 1.0.0 (custom)

Date Public

2026-09-20 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "REMS",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThanOrEqual": "1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-09-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree REMS through 1.0.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access Governance API endpoints, including /api/v1/databases. Attackers can send requests without an Authorization header, or with invalid or tampered JWT tokens, to retrieve stored database hosts, usernames, and passwords."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T18:11:15.982Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/493d542098b328570f821dc152146732"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://gist.github.com/neelkotnis/3fc4a8587179a8691ed89056ea7df076"
        },
        {
          "name": "REMS by OpsTree Product Page",
          "tags": [
            "product"
          ],
          "url": "https://opstree.com/rems-ai-powered-observability/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree REMS through 1.0.0 Missing Authentication via /api/v1/databases Governance API",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-missing-authentication-via-api-v1-databases-governance-api"
        }
      ],
      "title": "OpsTree REMS through 1.0.0 Missing Authentication via /api/v1/databases Governance API",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-126769",
    "datePublished": "2026-11-11T18:11:15.982Z",
    "dateReserved": "2026-11-11T18:05:55.843Z",
    "dateUpdated": "2026-11-11T18:11:15.982Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126768 (GCVE-0-2026-126768)

Vulnerability from nvd – Published: 2026-11-11 18:11 – Updated: 2026-11-11 18:11

Title

OpsTree REMS through 1.0.0 Authentication Bypass via is_local_auth Flag

Summary

OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the client-controlled is_local_auth field. Attackers can send a POST /api/v1/user/login/ request for the admin account with an invalid password and is_local_auth true to gain SuperUser administrative access.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-287 - Improper Authentication

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7828 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/4676fe10859d84…	technical-descriptionexploit
https://opstree.com/rems-ai-powered-observability/	product
https://www.vulncheck.com/advisories/opstree-rems…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	REMS	Affected: 0 , ≤ 1.0.0 (custom)

Date Public

2026-09-20 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "REMS",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThanOrEqual": "1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-09-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the client-controlled is_local_auth field. Attackers can send a POST /api/v1/user/login/ request for the admin account with an invalid password and is_local_auth true to gain SuperUser administrative access."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T18:11:15.375Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/4676fe10859d84900025cf52188dae46"
        },
        {
          "name": "REMS by OpsTree Product Page",
          "tags": [
            "product"
          ],
          "url": "https://opstree.com/rems-ai-powered-observability/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree REMS through 1.0.0 Authentication Bypass via is_local_auth Flag",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-authentication-bypass-via-is-local-auth-flag"
        }
      ],
      "title": "OpsTree REMS through 1.0.0 Authentication Bypass via is_local_auth Flag",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-126768",
    "datePublished": "2026-11-11T18:11:15.375Z",
    "dateReserved": "2026-11-11T18:05:55.484Z",
    "dateUpdated": "2026-11-11T18:11:15.375Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126767 (GCVE-0-2026-126767)

Vulnerability from nvd – Published: 2026-11-11 18:11 – Updated: 2026-11-11 18:11

Title

OpsTree REMS through 1.0.0 Prompt Injection via RCA Chat Assistant

Summary

OpsTree REMS through 1.0.0 contains a prompt injection vulnerability that allows authenticated users to disclose the hidden system prompt by submitting crafted chat input to POST /api/v1/rca/chat. Attackers can instruct the assistant to ignore its rules and reveal internal orchestration instructions, aiding the crafting of further prompt injection attacks.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-1427 - Improper Neutralization of Input Used for LLM Prompting

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7828 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/548bfde3e45bc3…	technical-descriptionexploit
https://opstree.com/rems-ai-powered-observability/	product
https://www.vulncheck.com/advisories/opstree-rems…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	REMS	Affected: 0 , ≤ 1.0.0 (custom)

Date Public

2026-09-20 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "REMS",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThanOrEqual": "1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-09-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree REMS through 1.0.0 contains a prompt injection vulnerability that allows authenticated users to disclose the hidden system prompt by submitting crafted chat input to POST /api/v1/rca/chat. Attackers can instruct the assistant to ignore its rules and reveal internal orchestration instructions, aiding the crafting of further prompt injection attacks."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1427",
              "description": "Improper Neutralization of Input Used for LLM Prompting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T18:11:14.745Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/548bfde3e45bc3793f3f26e1f9a43efe"
        },
        {
          "name": "REMS by OpsTree Product Page",
          "tags": [
            "product"
          ],
          "url": "https://opstree.com/rems-ai-powered-observability/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree REMS through 1.0.0 Prompt Injection via RCA Chat Assistant",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-prompt-injection-via-rca-chat-assistant"
        }
      ],
      "title": "OpsTree REMS through 1.0.0 Prompt Injection via RCA Chat Assistant",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-126767",
    "datePublished": "2026-11-11T18:11:14.745Z",
    "dateReserved": "2026-11-11T18:01:46.581Z",
    "dateUpdated": "2026-11-11T18:11:14.745Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126766 (GCVE-0-2026-126766)

Vulnerability from nvd – Published: 2026-11-11 18:11 – Updated: 2026-11-11 18:11

Title

OpsTree REMS through 1.0.0 Reporter Spoofing via /api/v1/incidents

Summary

OpsTree REMS through 1.0.0 contains an improper authorization vulnerability that allows authenticated users to set an incident's reporter to another user by supplying a client-controlled reporter field. Attackers can send crafted POST /api/v1/incidents or PATCH /api/v1/incidents/{id}/status requests to falsify incident attribution and corrupt the accountability audit trail.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7828 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/e11fb4f70d8ec8…	technical-descriptionexploit
https://opstree.com/rems-ai-powered-observability/	product
https://www.vulncheck.com/advisories/opstree-rems…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	REMS	Affected: 0 , ≤ 1.0.0 (custom)

Date Public

2026-09-20 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "REMS",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThanOrEqual": "1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-09-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree REMS through 1.0.0 contains an improper authorization vulnerability that allows authenticated users to set an incident\u0027s reporter to another user by supplying a client-controlled reporter field. Attackers can send crafted POST /api/v1/incidents or PATCH /api/v1/incidents/{id}/status requests to falsify incident attribution and corrupt the accountability audit trail."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T18:11:14.127Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/e11fb4f70d8ec850fa601566b95472a4"
        },
        {
          "name": "REMS by OpsTree Product Page",
          "tags": [
            "product"
          ],
          "url": "https://opstree.com/rems-ai-powered-observability/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree REMS through 1.0.0 Reporter Spoofing via /api/v1/incidents",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-reporter-spoofing-via-api-v1-incidents"
        }
      ],
      "title": "OpsTree REMS through 1.0.0 Reporter Spoofing via /api/v1/incidents",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-126766",
    "datePublished": "2026-11-11T18:11:14.127Z",
    "dateReserved": "2026-11-11T18:01:46.200Z",
    "dateUpdated": "2026-11-11T18:11:14.127Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126772 (GCVE-0-2026-126772)

Vulnerability from cvelistv5 – Published: 2026-11-11 18:11 – Updated: 2026-11-11 18:11

Title

OpsTree REMS through 1.0.0 Comment Author Spoofing via Incident Comment API

Summary

OpsTree REMS through 1.0.0 contains an improper attribution vulnerability that allows authenticated users to post comments as the incident creator via POST /api/v1/incidents/{incident_id}/comment. Lower-privileged attackers can comment on incidents owned by users such as a Super User to impersonate them and corrupt the incident timeline and audit trail.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7828 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/5a5c810e16a3f2…	technical-descriptionexploit
https://opstree.com/rems-ai-powered-observability/	product
https://www.vulncheck.com/advisories/opstree-rems…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	REMS	Affected: 0 , ≤ 1.0.0 (custom)

Date Public

2026-09-20 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "REMS",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThanOrEqual": "1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-09-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree REMS through 1.0.0 contains an improper attribution vulnerability that allows authenticated users to post comments as the incident creator via POST /api/v1/incidents/{incident_id}/comment. Lower-privileged attackers can comment on incidents owned by users such as a Super User to impersonate them and corrupt the incident timeline and audit trail."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T18:11:17.898Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/5a5c810e16a3f242f336198b32213629"
        },
        {
          "name": "REMS by OpsTree Product Page",
          "tags": [
            "product"
          ],
          "url": "https://opstree.com/rems-ai-powered-observability/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree REMS through 1.0.0 Comment Author Spoofing via Incident Comment API",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-comment-author-spoofing-via-incident-comment-api"
        }
      ],
      "title": "OpsTree REMS through 1.0.0 Comment Author Spoofing via Incident Comment API",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-126772",
    "datePublished": "2026-11-11T18:11:17.898Z",
    "dateReserved": "2026-11-11T18:05:56.862Z",
    "dateUpdated": "2026-11-11T18:11:17.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126771 (GCVE-0-2026-126771)

Vulnerability from cvelistv5 – Published: 2026-11-11 18:11 – Updated: 2026-11-11 18:11

Title

OpsTree REMS through 1.0.0 Stored XSS via Attachment Upload and Preview

Summary

OpsTree REMS through 1.0.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts by uploading attachments with spoofed text/html Content-Type. Attackers can upload HTML files named like test.html.pdf that render in the REMS origin via Preview, executing JavaScript in victims' browsers.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7828 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/ddf75e2cb71921…	technical-descriptionexploit
https://opstree.com/rems-ai-powered-observability/	product
https://www.vulncheck.com/advisories/opstree-rems…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	REMS	Affected: 0 , ≤ 1.0.0 (custom)

Date Public

2026-09-20 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "REMS",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThanOrEqual": "1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-09-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree REMS through 1.0.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts by uploading attachments with spoofed text/html Content-Type. Attackers can upload HTML files named like test.html.pdf that render in the REMS origin via Preview, executing JavaScript in victims\u0027 browsers."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T18:11:17.246Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/ddf75e2cb7192180e6c9618d27d1e99b"
        },
        {
          "name": "REMS by OpsTree Product Page",
          "tags": [
            "product"
          ],
          "url": "https://opstree.com/rems-ai-powered-observability/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree REMS through 1.0.0 Stored XSS via Attachment Upload and Preview",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-stored-xss-via-attachment-upload-and-preview"
        }
      ],
      "title": "OpsTree REMS through 1.0.0 Stored XSS via Attachment Upload and Preview",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-126771",
    "datePublished": "2026-11-11T18:11:17.246Z",
    "dateReserved": "2026-11-11T18:05:56.522Z",
    "dateUpdated": "2026-11-11T18:11:17.246Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126770 (GCVE-0-2026-126770)

Vulnerability from cvelistv5 – Published: 2026-11-11 18:11 – Updated: 2026-11-11 18:11

Title

OpsTree REMS through 1.0.0 SSRF via Database Test Connection

Summary

OpsTree REMS through 1.0.0 contains a server-side request forgery vulnerability that allows authenticated users to make the backend connect to arbitrary destinations through the database Test Connection feature. Attackers can set a database entry's host and port to localhost, internal addresses, or attacker-controlled servers to probe internal hosts and ports reachable from the REMS server.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7828 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/3c4a44d71e8f08…	technical-descriptionexploit
https://opstree.com/rems-ai-powered-observability/	product
https://www.vulncheck.com/advisories/opstree-rems…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	REMS	Affected: 0 , ≤ 1.0.0 (custom)

Date Public

2026-09-20 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "REMS",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThanOrEqual": "1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-09-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree REMS through 1.0.0 contains a server-side request forgery vulnerability that allows authenticated users to make the backend connect to arbitrary destinations through the database Test Connection feature. Attackers can set a database entry\u0027s host and port to localhost, internal addresses, or attacker-controlled servers to probe internal hosts and ports reachable from the REMS server."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T18:11:16.626Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/3c4a44d71e8f08747fbac13b2be87427"
        },
        {
          "name": "REMS by OpsTree Product Page",
          "tags": [
            "product"
          ],
          "url": "https://opstree.com/rems-ai-powered-observability/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree REMS through 1.0.0 SSRF via Database Test Connection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-ssrf-via-database-test-connection"
        }
      ],
      "title": "OpsTree REMS through 1.0.0 SSRF via Database Test Connection",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-126770",
    "datePublished": "2026-11-11T18:11:16.626Z",
    "dateReserved": "2026-11-11T18:05:56.194Z",
    "dateUpdated": "2026-11-11T18:11:16.626Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126769 (GCVE-0-2026-126769)

Vulnerability from cvelistv5 – Published: 2026-11-11 18:11 – Updated: 2026-11-11 18:11

Title

OpsTree REMS through 1.0.0 Missing Authentication via /api/v1/databases Governance API

Summary

OpsTree REMS through 1.0.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access Governance API endpoints, including /api/v1/databases. Attackers can send requests without an Authorization header, or with invalid or tampered JWT tokens, to retrieve stored database hosts, usernames, and passwords.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7828 records in the last 180 days details

References

4 references

URL	Tags
https://gist.github.com/neelkotnis/493d542098b328…	technical-descriptionexploit
https://gist.github.com/neelkotnis/3fc4a8587179a8…	technical-description
https://opstree.com/rems-ai-powered-observability/	product
https://www.vulncheck.com/advisories/opstree-rems…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	REMS	Affected: 0 , ≤ 1.0.0 (custom)

Date Public

2026-09-20 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "REMS",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThanOrEqual": "1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-09-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree REMS through 1.0.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access Governance API endpoints, including /api/v1/databases. Attackers can send requests without an Authorization header, or with invalid or tampered JWT tokens, to retrieve stored database hosts, usernames, and passwords."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T18:11:15.982Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/493d542098b328570f821dc152146732"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://gist.github.com/neelkotnis/3fc4a8587179a8691ed89056ea7df076"
        },
        {
          "name": "REMS by OpsTree Product Page",
          "tags": [
            "product"
          ],
          "url": "https://opstree.com/rems-ai-powered-observability/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree REMS through 1.0.0 Missing Authentication via /api/v1/databases Governance API",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-missing-authentication-via-api-v1-databases-governance-api"
        }
      ],
      "title": "OpsTree REMS through 1.0.0 Missing Authentication via /api/v1/databases Governance API",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-126769",
    "datePublished": "2026-11-11T18:11:15.982Z",
    "dateReserved": "2026-11-11T18:05:55.843Z",
    "dateUpdated": "2026-11-11T18:11:15.982Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126768 (GCVE-0-2026-126768)

Vulnerability from cvelistv5 – Published: 2026-11-11 18:11 – Updated: 2026-11-11 18:11

Title

OpsTree REMS through 1.0.0 Authentication Bypass via is_local_auth Flag

Summary

OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the client-controlled is_local_auth field. Attackers can send a POST /api/v1/user/login/ request for the admin account with an invalid password and is_local_auth true to gain SuperUser administrative access.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-287 - Improper Authentication

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7828 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/4676fe10859d84…	technical-descriptionexploit
https://opstree.com/rems-ai-powered-observability/	product
https://www.vulncheck.com/advisories/opstree-rems…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	REMS	Affected: 0 , ≤ 1.0.0 (custom)

Date Public

2026-09-20 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "REMS",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThanOrEqual": "1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-09-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the client-controlled is_local_auth field. Attackers can send a POST /api/v1/user/login/ request for the admin account with an invalid password and is_local_auth true to gain SuperUser administrative access."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T18:11:15.375Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/4676fe10859d84900025cf52188dae46"
        },
        {
          "name": "REMS by OpsTree Product Page",
          "tags": [
            "product"
          ],
          "url": "https://opstree.com/rems-ai-powered-observability/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree REMS through 1.0.0 Authentication Bypass via is_local_auth Flag",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-authentication-bypass-via-is-local-auth-flag"
        }
      ],
      "title": "OpsTree REMS through 1.0.0 Authentication Bypass via is_local_auth Flag",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-126768",
    "datePublished": "2026-11-11T18:11:15.375Z",
    "dateReserved": "2026-11-11T18:05:55.484Z",
    "dateUpdated": "2026-11-11T18:11:15.375Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126767 (GCVE-0-2026-126767)

Vulnerability from cvelistv5 – Published: 2026-11-11 18:11 – Updated: 2026-11-11 18:11

Title

OpsTree REMS through 1.0.0 Prompt Injection via RCA Chat Assistant

Summary

OpsTree REMS through 1.0.0 contains a prompt injection vulnerability that allows authenticated users to disclose the hidden system prompt by submitting crafted chat input to POST /api/v1/rca/chat. Attackers can instruct the assistant to ignore its rules and reveal internal orchestration instructions, aiding the crafting of further prompt injection attacks.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-1427 - Improper Neutralization of Input Used for LLM Prompting

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7828 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/548bfde3e45bc3…	technical-descriptionexploit
https://opstree.com/rems-ai-powered-observability/	product
https://www.vulncheck.com/advisories/opstree-rems…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	REMS	Affected: 0 , ≤ 1.0.0 (custom)

Date Public

2026-09-20 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "REMS",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThanOrEqual": "1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-09-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree REMS through 1.0.0 contains a prompt injection vulnerability that allows authenticated users to disclose the hidden system prompt by submitting crafted chat input to POST /api/v1/rca/chat. Attackers can instruct the assistant to ignore its rules and reveal internal orchestration instructions, aiding the crafting of further prompt injection attacks."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1427",
              "description": "Improper Neutralization of Input Used for LLM Prompting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T18:11:14.745Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/548bfde3e45bc3793f3f26e1f9a43efe"
        },
        {
          "name": "REMS by OpsTree Product Page",
          "tags": [
            "product"
          ],
          "url": "https://opstree.com/rems-ai-powered-observability/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree REMS through 1.0.0 Prompt Injection via RCA Chat Assistant",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-prompt-injection-via-rca-chat-assistant"
        }
      ],
      "title": "OpsTree REMS through 1.0.0 Prompt Injection via RCA Chat Assistant",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-126767",
    "datePublished": "2026-11-11T18:11:14.745Z",
    "dateReserved": "2026-11-11T18:01:46.581Z",
    "dateUpdated": "2026-11-11T18:11:14.745Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126766 (GCVE-0-2026-126766)

Vulnerability from cvelistv5 – Published: 2026-11-11 18:11 – Updated: 2026-11-11 18:11

Title

OpsTree REMS through 1.0.0 Reporter Spoofing via /api/v1/incidents

Summary

OpsTree REMS through 1.0.0 contains an improper authorization vulnerability that allows authenticated users to set an incident's reporter to another user by supplying a client-controlled reporter field. Attackers can send crafted POST /api/v1/incidents or PATCH /api/v1/incidents/{id}/status requests to falsify incident attribution and corrupt the accountability audit trail.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7828 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/e11fb4f70d8ec8…	technical-descriptionexploit
https://opstree.com/rems-ai-powered-observability/	product
https://www.vulncheck.com/advisories/opstree-rems…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	REMS	Affected: 0 , ≤ 1.0.0 (custom)

Date Public

2026-09-20 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "REMS",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThanOrEqual": "1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-09-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree REMS through 1.0.0 contains an improper authorization vulnerability that allows authenticated users to set an incident\u0027s reporter to another user by supplying a client-controlled reporter field. Attackers can send crafted POST /api/v1/incidents or PATCH /api/v1/incidents/{id}/status requests to falsify incident attribution and corrupt the accountability audit trail."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T18:11:14.127Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/e11fb4f70d8ec850fa601566b95472a4"
        },
        {
          "name": "REMS by OpsTree Product Page",
          "tags": [
            "product"
          ],
          "url": "https://opstree.com/rems-ai-powered-observability/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree REMS through 1.0.0 Reporter Spoofing via /api/v1/incidents",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-reporter-spoofing-via-api-v1-incidents"
        }
      ],
      "title": "OpsTree REMS through 1.0.0 Reporter Spoofing via /api/v1/incidents",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-126766",
    "datePublished": "2026-11-11T18:11:14.127Z",
    "dateReserved": "2026-11-11T18:01:46.200Z",
    "dateUpdated": "2026-11-11T18:11:14.127Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

14 vulnerabilities by OpsTree Solutions

CVE-2026-126772 (GCVE-0-2026-126772)

CVE-2026-126771 (GCVE-0-2026-126771)

CVE-2026-126770 (GCVE-0-2026-126770)

CVE-2026-126769 (GCVE-0-2026-126769)

CVE-2026-126768 (GCVE-0-2026-126768)

CVE-2026-126767 (GCVE-0-2026-126767)

CVE-2026-126766 (GCVE-0-2026-126766)

CVE-2026-126772 (GCVE-0-2026-126772)

CVE-2026-126771 (GCVE-0-2026-126771)

CVE-2026-126770 (GCVE-0-2026-126770)

CVE-2026-126769 (GCVE-0-2026-126769)

CVE-2026-126768 (GCVE-0-2026-126768)

CVE-2026-126767 (GCVE-0-2026-126767)

CVE-2026-126766 (GCVE-0-2026-126766)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

14 vulnerabilities by OpsTree Solutions

CVE-2026-126772 (GCVE-0-2026-126772)

CVE-2026-126771 (GCVE-0-2026-126771)

CVE-2026-126770 (GCVE-0-2026-126770)

CVE-2026-126769 (GCVE-0-2026-126769)

CVE-2026-126768 (GCVE-0-2026-126768)

CVE-2026-126767 (GCVE-0-2026-126767)

CVE-2026-126766 (GCVE-0-2026-126766)

CVE-2026-126772 (GCVE-0-2026-126772)

CVE-2026-126771 (GCVE-0-2026-126771)

CVE-2026-126770 (GCVE-0-2026-126770)

CVE-2026-126769 (GCVE-0-2026-126769)

CVE-2026-126768 (GCVE-0-2026-126768)

CVE-2026-126767 (GCVE-0-2026-126767)

CVE-2026-126766 (GCVE-0-2026-126766)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.