CVE-2026-62238highCWE-89

CVE-2026-62238: high-severity vulnerability in openremote

OpenRemote < 1.26.0 SQL Injection via Crosstab Export

Published · Updated

Follow this CVE+ Monitor openremote+ Monitor io.openremote:openremote-manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2epss 0.5%
OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV response, enabling database data exfiltration.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
openremote · openremote
Related CVEs — openremote

In the same product, most dangerous first.

CVE-2026-39842CRITICALOpenRemote is Vulnerable to Expression InjectionEPSS 0.9%CVE-2026-66013CRITICALOpenRemote before 1.26.2 Authentication Bypass via Console RegistrationEPSS 0.7%CVE-2026-81679HIGHOpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification APIEPSS 0.4%CVE-2026-114661CRITICALOpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel EndpointsEPSS 0.4%CVE-2026-63224HIGHOpenRemote has authenticated SQL injection in crosstab datapoint exportsEPSS 0.3%CVE-2026-56784HIGHOpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion EndpointEPSS 0.3%