CVE-2026-62238CWE-89sql-injection

CVE-2026-62238

High · published July 17, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
41.8
In the wild
Unconfirmed
What it is

OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV response, enabling database data exfiltration.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00498 · 41.8th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-07-17T06:18Z
Affected products (1)
ProductVersionsFixed in
openremote/openremote< 1.26.01.26.0
References (3)
https://github.com/openremote/openremote/security/advisories/GHSA-cgfv-jrfp-2r7v · [email protected]https://www.vulncheck.com/advisories/openremote-sql-injection-via-crosstab-export · [email protected]https://github.com/openremote/openremote/security/advisories/GHSA-cgfv-jrfp-2r7v · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 JUL 00:07Z
    OpenRemote < 1.26.0 SQL Injection via Crosstab Export
    cvelistv5