CVE-2026-62238: OpenRemote < 1.26.0 SQL Injection via Crosstab Export
OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV response, enabling database data exfiltration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenRemoteto a version that resolves this vulnerability.Fixed in 1.26.0 - Configuration
Update OpenRemote to a version where the datapoint crosstab export endpoint no longer concatenates asset display names into raw SQL (SQLi fix for versions before 1.26.0).
OpenRemote datapoint crosstab export endpoint asset name / asset display name handling = do not construct PostgreSQL queries by concatenating asset display names into raw SQL
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62238?
CVE-2026-62238 has a high severity rating of 7.2 according to the CVSS scoring system.
How do I fix CVE-2026-62238?
To fix CVE-2026-62238, upgrade OpenRemote to version 1.26.0 or later, where the vulnerability is patched.
What type of vulnerability is CVE-2026-62238?
CVE-2026-62238 is classified as an SQL Injection vulnerability.
Who can exploit CVE-2026-62238?
An authenticated attacker with asset creation or rename permissions can exploit CVE-2026-62238 to inject SQL.
What component of OpenRemote is affected by CVE-2026-62238?
CVE-2026-62238 affects the datapoint crosstab export endpoint in OpenRemote versions before 1.26.0.