Which versions of OpenRemote are affected by CVE-2026-62238?

OpenRemote versions before 1.26.0 contain a SQL injection vulnerability in the datapoint crosstab export endpoint that allows authenticated users with asset creation or rename permissions to…. A patch is available.

How to fix or mitigate CVE-2026-62238?

Within 24 hours, inventory all OpenRemote deployments and identify which are multi-tenant configurations; immediately restrict asset creation and rename permissions to administrative users only and audit recent permission assignments for abnormal activity. Within 7 days, implement network-level access controls or WAF rules to restrict the /datapoint/crosstab/export endpoint to essential administrators only, and enable database query logging to detect anomalous SQL patterns in PostgreSQL logs. Within 30 days, monitor OpenRemote release channels for patch availability targeting version 1.26.0 or later, engage with vendor on patch timelines, and prepare a staged upgrade plan to deploy patches to all instances as they become available.

OpenRemote CVE-2026-62238

Q: What is the CVSS score of CVE-2026-62238?

CVE-2026-62238 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-45084 HIGH

SQL Injection (CWE-89)

2026-07-17 VulnCheck

GHSA-rw7h-h988-gfff

SQLi PostgreSQL Openremote

7.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.6 HIGH

Network-reachable authenticated SQLi needing only asset create/rename rights (PR:L, AC:L); primarily data read (C:H) with limited write/DoS via SQL (I:L/A:L), same-DB-role scope so S:U.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 02:32 EUVD

Source Code Evidence Fetched

Jul 17, 2026 - 00:52 vuln.today

Analysis Generated

Jul 17, 2026 - 00:52 vuln.today

CVE Published

Jul 17, 2026 - 00:07 cve.org

HIGH 7.2

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 maven packages depend on io.openremote:openremote-manager (5 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.26.0.

DescriptionCVE.org

OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV response, enabling database data exfiltration.

AnalysisAI

SQL injection in OpenRemote's datapoint crosstab export endpoint (all versions before 1.26.0) lets an authenticated user with asset creation or rename permissions exfiltrate database contents by embedding SQL into an asset display name that is concatenated into a raw PostgreSQL crosstab query. Injected SELECT results are streamed back inside the ZIP/CSV export response, giving a practical read primitive against any table the manager's database role can reach - including other tenants' data in multi-tenant deployments. Publicly available exploit code exists (VulnCheck/GHSA proof of concept); no active exploitation has been reported.

Technical ContextAI

OpenRemote is an open-source IoT/asset-management platform whose manager service exports time-series datapoints as CSV crosstab reports. The export builder derives a crosstab column header from the asset display name and attribute name, then embeds that attacker-controllable string into raw SQL in two places: a PostgreSQL double-quoted column identifier ("<asset name> : <attribute name>" text) and the category query passed to the crosstab(...) function inside a COPY (SELECT ... FROM crosstab(...)) TO STDOUT statement. Because the display name is concatenated rather than parameterized, this is a textbook CWE-89 (SQL Injection) via a second-order/stored input path - the malicious value is persisted as an asset name and only executed later when the crosstab export runs. The affected component is the datapoint export API for asset datapoints, specifically CSV crosstab-style formats, in cpe:2.3:a:openremote:openremote.

RemediationAI

Vendor-released patch: upgrade OpenRemote to 1.26.0 or later, which fixes the query construction (fix commit 02ac83074b81617add814b2a72d459abdf374147); see the advisory at https://github.com/openremote/openremote/security/advisories/GHSA-cgfv-jrfp-2r7v. If immediate patching is not possible, restrict who can create or rename assets and who can access crosstab datapoint export so that only fully trusted operators hold those permissions (trade-off: limits legitimate asset management and self-service reporting). As a defense-in-depth control, run the manager's PostgreSQL connection under a least-privilege database role scoped only to the tables the application needs, so an injected SELECT cannot read shared manager tables across realms (trade-off: requires careful grant auditing and may break features that expect broader access). In multi-tenant setups, consider separating tenant data at the database or schema level to blunt cross-realm exfiltration until the upgrade is applied.