OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV response, enabling database data exfiltration.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/openremote/openremote/security/advisories/GHSA-cgfv-jrfp-2r7v Exploit, Mitigation, Vendor Advisory
- https://github.com/openremote/openremote/security/advisories/GHSA-cgfv-jrfp-2r7v Exploit, Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.2 · openremoteNVD modified 2026-10-08 16:17
Affected (CPE criteria) 1
cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:*
References 3
- https://github.com/openremote/openremote/security/advisories/GHSA-cgfv-jrfp-2r7v Exploit, Mitigation, Vendor Advisory
- https://www.vulncheck.com/advisories/openremote-sql-injection-via-crosstab-export Third Party Advisory
- https://github.com/openremote/openremote/security/advisories/GHSA-cgfv-jrfp-2r7v Exploit, Mitigation, Vendor Advisory