CVE-2026-39842

OpenRemote versions 1.21.0 and below contain critical expression injection vulnerabilities in both the JavaScript and Groovy rules engines that allow unauthenticated arbitrary code execution. The JavaScript rules engine lacks sandboxing and class filtering, while the Groovy engine's security filter is defined but not activated. Any user with write:rules role can exploit these flaws to execute malicious code with full JVM privileges, enabling remote code execution as root, credential theft, and cross-tenant data access. The vulnerability carries a CVSS score of 9.9 (Critical) with a network-based attack vector requiring only low privilege (write:rules role) and no user interaction, affecting system confidentiality, integrity, and availability across tenant boundaries. The attack complexity is low, making exploitation straightforward for any authenticated attacker with the specified role. The potential impact is severe, including complete server compromise, sensitive data exfiltration, and bypassing multi-tenant isolation controls. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and shows no public exploit code availability. Community attention appears limited given the low EPSS score of 0.0006. Organizations running OpenRemote should prioritize upgrading to version 1.22.0 to remediate these critical flaws, particularly if instances are accessible to untrusted users with administrative roles.