OpsTree REMS AI observability platform discloses critical auth bypass and AI-chat prompt injection flaws

Five vulnerabilities disclosed in OpsTree's REMS AI observability platform include a critical authentication bypass granting admin access and a prompt-injection flaw that leaks the AI assistant's hidden system prompt.

OpsTree disclosed five security vulnerabilities in its AI-powered observability platform, REMS, by publishing the GHSA-crpx-jj3g-c9f4 advisory to the GitHub Advisory Database on November 11, 2026. The most severe issue is a critical authentication bypass that grants full admin access, alongside a prompt-injection flaw in REMS's AI root-cause-analysis chat assistant.

Five vulnerabilities in REMS through version 1.0.0

GHSA-crpx-jj3g-c9f4 / CVE-2026-126768 (critical, CVSS 9.3): posting is_local_auth as true with any invalid password to /api/v1/user/login/ returns a valid admin JWT.
GHSA-4f34-q9vf-fwfg advisory / CVE-2026-126767 (moderate, CVSS 5.3): a prompt injection via POST /api/v1/rca/chat lets a low-privilege authenticated user extract the hidden system prompt and internal orchestration instructions.
GHSA-rxpf-ghf8-22v2 / CVE-2026-126769 (high, CVSS 8.7): missing authentication on /api/v1/databases exposes stored database hosts, usernames and passwords.
GHSA-jr8q-q76f-qjgh / CVE-2026-126770 (moderate, CVSS 5.3): server-side request forgery through the database Test Connection feature, usable for internal network reconnaissance.
GHSA-3hxm-mrvc-44mw / CVE-2026-126771 (moderate, CVSS 5.1): stored cross-site scripting via attachment upload using a spoofed text/html Content-Type.

Why it matters for AI builders

The combination shows how quickly an AI chat assistant embedded in an ops or observability tool can become a path to full admin takeover: the prompt-injection flaw alone lets an attacker pull the assistant's hidden instructions, and the authentication bypass turns any invalid login attempt into an admin session.

Patching status

None of the five advisories lists a patched version of REMS, so teams running it through version 1.0.0 have no fixed release to upgrade to yet.

Sources

GHSA-crpx-jj3g-c9f4 (GitHub Advisory Database, November 11, 2026, official)
GHSA-4f34-q9vf-fwfg (GitHub Advisory Database, November 11, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.