CVE-2026-62238

High

Description

OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV response, enabling database data exfiltration.

SeverityHigh

CVSS8.8

Exploit probability—

ProductOpenremote

PublishedJul 17, 2026

First seenJul 17, 2026

Weakness typeCWE-89SQL injection

How to fix

Update

openremote openremote1.26.0 or later
io.openremote:openremote-manager1.26.0 or later

Vendor advisories

github.com/openremote/openremote/security/advisories/GHSA-cgfv-jrfp-2r7v

Affected products

Product	Affected versions	Fixed in
openremote openremote	v < 1.26.0	1.26.0
io.openremote:openremote-managerMaven	v < 1.26.0	1.26.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.