What’s Vulnerable › Vulnerabilities

CVE-2026-62238: OpenRemote < 1.26.0 SQL Injection via Crosstab Export

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-07-17 · updated 2026-10-24
• Weakness: CWE-89

Description

OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV response, enabling database data exfiltration.

Affected products

• openremote: before 1.26.0 — fixed in 1.26.0

How to fix

Upgrade to a fixed version: openremote 1.26.0. Check the vendor advisory for mitigations.

References

• https://github.com/openremote/openremote/security/advisories/GHSA-cgfv-jrfp-2r7v
• https://www.vulncheck.com/advisories/openremote-sql-injection-via-crosstab-export
• https://github.com/openremote/openremote/security/advisories/GHSA-cgfv-jrfp-2r7v

Get alerted when CVE-2026-62238 or the next vulnerability affects your stack