CVE-2026-62238

EUVD-2026-45084
OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV response, enabling database data exfiltration.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7.2 HIGH
NETWORK
LOW
LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 11%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
openremoteopenremote
𝑥
< 1.26.0
CNA
Common Weakness Enumeration
References
https://github.com/openremote/openremote/security/advisories/GHSA-cgfv-jrfp-2r7v
https://www.vulncheck.com/advisories/openremote-sql-injection-via-crosstab-export
https://github.com/openremote/openremote/security/advisories/GHSA-cgfv-jrfp-2r7v