CVE-2026-62238
OpenRemote < 1.26.0 SQL Injection via Crosstab Export
- State
- Published
- Severity
- 7.2 High
- Published
- Jul 17, 2026
- Updated
- Oct 8, 2026
- Reserved
- Jul 13, 2026
Description
OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV response, enabling database data exfiltration.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.2 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
openremoteopenremote |
|
References
- GitHub Security Advisory (GHSA-cgfv-jrfp-2r7v)vendor-advisory
- VulnCheck Advisory: OpenRemote < 1.26.0 SQL Injection via Crosstab Exportthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.