Threat
NVD-CVE-2026-126767
Publication date unknown · Discovered nist.gov
Page published
Publication date unknown · First observed: 14 Nov 2026
Coverage timeline
Single-source advisory — one report is available.
Why it matters
The OpsTree REMS vulnerability exposes internal assistant instructions to authenticated users, giving attackers information that can support more targeted prompt injection attempts.
CVE-2026-126767 is a prompt injection vulnerability in OpsTree REMS through version 1.0.0 that allows authenticated users to disclose the hidden system prompt through crafted input to POST /api/v1/rca/chat. The disclosed orchestration instructions can help attackers craft further prompt injection attacks; VulnCheck assigns a CVSS 4.0 score of 5.3 (Medium).