OpenRemote CVE-2026-63224

Requires an authenticated session plus permission to create or rename at least one asset, permission to read/export datapoints for at least one attribute on that asset, and access to a CSV crosstab datapoint export format (CSV_CROSSTAB or CSV_CROSSTAB_MINUTE). The injection is carried through the asset display name, which is concatenated into both a double-quoted SQL identifier and a $cat$ dollar-quoted category query, and triggered only via the crosstab export path - non-crosstab export formats do not reach this vulnerable query builder. No direct database access, server filesystem access, or token forgery is needed. Limiting factors: authentication is mandatory (PR:L, not unauthenticated), the attacker must hold asset write/export capability, and cross-tenant exfiltration additionally depends on the manager's PostgreSQL role having read access to other realms' shared tables.

This is a genuine, actionable vulnerability but not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:L/VA:L, SC:N) scores 7.2 (High) and is internally consistent with the description: it is network-reachable through the authenticated manager API, low-complexity once authenticated, and requires low privileges (PR:L) - specifically the ordinary ability to create/rename an asset and read/export its datapoints, not administrative rights. Confidentiality impact is high (database exfiltration, potentially cross-tenant), while integrity and availability are only low because the demonstrated primitive is read-only; the advisory explicitly states integrity/availability effects were not established. No EPSS score was supplied and the vulnerability is not in CISA KEV, so there is no evidence of widespread or active exploitation; the vuln.today decision label is 'this_week', consistent with a prioritize-but-not-emergency posture. The GHSA advisory documents a working researcher proof-of-concept (it safely returned current_user, current_database(), and an aggregate row count), but no standalone public exploit code reference is provided in the input. The main nuance to verify: the real-world blast radius depends on the PostgreSQL role the manager service uses - cross-tenant/shared-table exposure is possible only if that role can read those tables, which is a deployment-specific condition the CVE cannot confirm per environment.

A low-privileged but authenticated OpenRemote user who can create or rename an asset stores SQL metacharacters in the asset's display name, writes a datapoint value for one of its attributes, then requests a CSV crosstab datapoint export for that attribute. Because the asset name is concatenated into a COPY (SELECT ... FROM crosstab(...)) TO STDOUT statement as both a double-quoted identifier and a dollar-quoted category value, the injected SELECT runs and its rows are streamed back inside the normal ZIP/CSV response, exfiltrating database contents. The GHSA advisory confirms a demonstrated proof-of-concept that retrieved database context and a table row count, though no weaponized exploit code is published in the available references.