Realm Admins Bypass Authorization Checks on Global Resources

OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resources by calling admin endpoints lacking super administrator checks. Attackers can change the global keycloakUrl via /configuration/manager to redirect other realms' console authentication for credential phishing, inject CSS, replace map tiles, and delete logs.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-124436 exposes a critical authorization flaw in OpenRemote versions before 1.32.2 where realm administrators can escalate privileges to access and modify global system resources. By exploiting admin endpoints that lack proper super administrator validation checks, attackers with realm-level access can manipulate critical infrastructure settings—particularly the global keycloakUrl configuration—to redirect authentication flows for credential harvesting. The vulnerability's impact extends beyond configuration tampering; attackers can inject malicious CSS, corrupt map tile systems, and destroy audit trails by deleting logs. This affects any organization deploying OpenRemote with multiple realms, where a compromised realm administrator account becomes a pivot point for lateral privilege escalation and infrastructure-wide compromise.

Casky's 283 matched skills leverage Claude AI with extended reasoning to detect the authorization bypass patterns mapped to MITRE ATT&CK's Privilege Escalation (TA0004) and Persistence (TA0006) techniques. Practitioners would observe skill findings identifying suspicious admin endpoint calls lacking authorization context validation, anomalous realm-to-global resource access patterns, and configuration changes at odds with administrative roles. The platform would flag the telltale indicators: unauthenticated global resource modifications, keycloakUrl alterations originating from realm admin credentials, CSS injection payloads in configuration updates, and accelerated log deletion events—each mapping to the CWE-863 improper authorization weakness. These granular detections enable security teams to distinguish legitimate administrative activity from privilege escalation attempts before infrastructure-level compromise occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-124436.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-124436

Casky has 283 skills that investigate the attack patterns behind CVE-2026-124436. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn