Not on CISA's list of exploited flaws, and not in the news we track.
0.77%
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-126768. Nothing runs until you send it.
OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the client-controlled is_local_auth field. Attackers can send a POST /api/v1/user/login/ request for the admin account with an invalid password and is_local_auth true to gain SuperUser administrative access.