CVE-2026-54640
1 advisory.
Maven/io.openremote:openremote-agent CVE-2026-54640: high 7.6
OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory
Action: Upgrade io.openremote:openremote-agent to 1.24.2 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.24.2 | - |
Fixed versions
| 1.24.2 |
Sources
- osv: GHSA-7v6w-c3f4-9wpq
- https://github.com/openremote/openremote/security/advisories/GHSA-7v6w-c3f4-9wpq
- https://github.com/openremote/openremote/commit/c28d3c60ebc2da68d9b6c4a6d7a5ad875a255ee9
- https://github.com/openremote/openremote
CVE-2026-54640 · published · modified · JSON