High severity · published Jul 17, 2026
CVE-2026-62238
OpenRemote < 1.26.0 SQL Injection via Crosstab Export
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV response, enabling database data exfiltration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openremote · openremote
before 1.26.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-62238
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-62238
vendor-advisory
https://github.com/openremote/openremote/security/advisories/GHSA-cgfv-jrfp-2r7v
third-party-advisory
https://www.vulncheck.com/advisories/openremote-sql-injection-via-crosstab-export
More from openremote
9.9
CVE-2026-39842
OpenRemote is Vulnerable to Expression Injection
9.8
CVE-2022-31860
An issue was discovered in OpenRemote through 1.0.4 allows attackers to execute arbitrary code via a crafted Groovy rule
9.3
CVE-2026-66013
OpenRemote before 1.26.2 Authentication Bypass via Console Registration
8.5
CVE-2026-114661
OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints
8.1
CVE-2026-56784
OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint