Vulnerability · Published Jul 17, 2026 · Assigned by VulnCheck

CVE-2026-62238OpenRemote < 1.26.0 SQL Injection via Crosstab Export

High 7.2

In plain English

A high-severity SQL injection in openremote from openremote. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.2High

Exploit odds (30 days)0.5%top 57.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV response, enabling database data exfiltration.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	io.openremote:openremote-manager	1.26.0	GHSA-cgfv-jrfp-2r7v

Affected products (as reported)

Vendor	Product	Versions
openremote	openremote	0 – before 1.26.0

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

References

GitHub Security Advisory (GHSA-cgfv-jrfp-2r7v) vendor-advisory
VulnCheck Advisory: OpenRemote < 1.26.0 SQL Injection via Crosstab Export third-party-advisory