CVE-2026-62238

UNKNOWN 0.0

OpenRemote < 1.26.0 SQL Injection via Crosstab Export

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV response, enabling database data exfiltration.

CWE	CWE-89
Vendor	openremote
Product	openremote
Published	Jul 17, 2026

Stay Ahead of the Next One

Get instant alerts for openremote openremote

Be the first to know when new unknown vulnerabilities affecting openremote openremote are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

openremote / openremote

0 < 1.26.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openremote/openremote/security/advisories/GHSA-cgfv-jrfp-2r7v vulncheck.com: https://www.vulncheck.com/advisories/openremote-sql-injection-via-crosstab-export

Credits

🔍 aramosf