SQL injection in OpenRemote datapoint export (CVE-2026-62238)

OpenRemote contains an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint, which constructs PostgreSQL queries by concatenating asset display names into raw SQL without adequate escaping. An authenticated attacker with permission to create or rename assets and export datapoints can inject SQL through the asset name, causing the backend to execute attacker-influenced SQL via the manager service's database connection, with injected query results returned inside the normal ZIP/CSV export response. In multi-tenant deployments, this may expose data outside the attacker's tenant if the application database role can read shared manager tables. Affected versions: - 1.25.0 We recommend updating to: 1.26.0. CVSS 7.2 · our assessment: this_week Vendor advisory: https://github.com/openremote/openremote/security/advisories/GHSA-cgfv-jrfp-2r7v Details: https://vuln.today/cve/CVE-2026-62238