CVE-2026-54640

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and XMLInputFactory parsers that permit external entity resolution. This incomplete remediation of CVE-2026-40882 leaves the KNX handler unprotected while the parallel Velbus handler is hardened, allowing a regular realm user to read files accessible to the JVM process or cause server-side requests. This issue is fixed in version 1.24.2.

• CWE-611

• https://github.com/openremote/core/commit/c28d3c60ebc2da68d9b6c4a6d7a5ad875a255ee9
• https://github.com/openremote/core/releases/tag/1.24.2
• https://github.com/openremote/core/security/advisories/GHSA-7v6w-c3f4-9wpq

Published

Oct 13, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54635pytonapi is a Python SDK for TONAPI that provides REST API, …7.5
• CVE-2026-54636Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron pl…9.9
• CVE-2026-54637Dragonfly is an open source P2P-based file distribution and …5.5
• CVE-2026-54638gotd/td is a T Telegram MTProto API client in Go. Prior to 0…7.5
• CVE-2026-54639Style Dictionary, a build system for creating cross-platform…8.8
• CVE-2026-5464The ExactMetrics – Google Analytics Dashboard for WordPress …7.2
• CVE-2026-54641OpenRemote is an open-source internet-of-things platform. Pr…7.7
• CVE-2026-54642CubeCart is an ecommerce software solution. Prior to 6.7.5, …5.3
• CVE-2026-54643CubeCart is an ecommerce software solution. Prior to 6.7.5, …5.4
• CVE-2026-54644CubeCart is an ecommerce software solution. Prior to 6.7.5, …6.1
• CVE-2026-54645CubeCart is an ecommerce software solution. Prior to 6.7.5, …4.8
• CVE-2026-54646CubeCart is an ecommerce software solution. Prior to 6.7.5, …7.2