CVE-2026-40882
High
Description
OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.0, the Velbus asset import path parses attacker-controlled XML without explicit XXE hardening. An authenticated user who can call the import endpoint may trigger XML external entity processing, which can lead to server-side file disclosure and SSRF. The target file must be less than 1023 characters. Version 1.22.0 fixes the issue.
SeverityHigh
CVSS7.6
Exploit probability—
ProductOpenremote
PublishedApr 22, 2026
First seenApr 22, 2026
Weakness typeCWE-611XML external entity (XXE)
How to fix
Update
- openremote openremote1.22.0 or later
- io.openremote:openremote-manager1.22.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openremote openremote | v < 1.22.0 | 1.22.0 |
| io.openremote:openremote-managerMaven | v < 1.22.0 | 1.22.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.