CVE-2026-62238 OpenRemote < 1.26.0 SQL Injection via Crosstab Export

What is CVE-2026-62238?

CVE-2026-62238 is a high-severity SQL injection vulnerability in openremote, published on 17 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV response, enabling database data exfiltration.

Weakness: CWE-89

Which versions are affected by CVE-2026-62238?

2 open source packages ship an affected version, including io.openremote:openremote-manager. It affects 1 product.

Products include Openremote Openremote.

How do I fix CVE-2026-62238?

Upgrade io.openremote:openremote-manager to 1.26.0 or later.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2026-62238 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-62238 exists.

Other vulnerabilities in openremote

• CVE-2026-39842 OpenRemote is Vulnerable to Expression Injection Critical 10.0
• CVE-2022-31860 Code injection in n/a Critical 9.8
• CVE-2026-40882 OpenRemote has XXE in Velbus Asset Import High 7.6
• CVE-2026-41166 OpenRemote has Improper Access Control via updateUserRealmRoles function High 7.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-cgfv-jrfp-2r7v, GHSA-rw7h-h988-gfff.