CVE-2026-62238 Overview
CVE-2026-62238 is an authenticated SQL injection vulnerability in OpenRemote versions before 1.26.0. The flaw exists in the datapoint crosstab export endpoint, which constructs PostgreSQL queries by concatenating asset display names directly into raw SQL. An authenticated attacker with permissions to create or rename assets can inject SQL through the asset name parameter. The injected query results are returned in the exported CSV response, enabling database data exfiltration. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Authenticated attackers can exfiltrate arbitrary database contents from the underlying PostgreSQL instance via crafted asset names surfaced through the CSV crosstab export.
Affected Products
- OpenRemote versions prior to 1.26.0
- OpenRemote datapoint crosstab export endpoint
- Deployments using PostgreSQL as the backing data store
Discovery Timeline
- 2026-07-17 - CVE-2026-62238 published to NVD
- 2026-07-17 - Last updated in NVD database
Technical Details for CVE-2026-62238
Vulnerability Analysis
The vulnerability resides in the datapoint crosstab export functionality of OpenRemote. The endpoint accepts asset display names and incorporates them into a PostgreSQL query using string concatenation rather than parameterized statements. Because the asset name field is user-controlled and persisted through legitimate asset creation or rename operations, an attacker with those permissions can seed malicious SQL fragments into the database. When the crosstab export runs, those fragments execute inside the query context.
The attacker retrieves the results directly through the CSV response returned by the export endpoint. This creates an in-band SQL injection primitive suitable for reading arbitrary tables, including credential material, device secrets, and telemetry history. The Exploit Prediction Scoring System (EPSS) probability is 0.211%.
Root Cause
The root cause is unsafe query construction. Asset display names flow from persistent storage into the SQL string used by the crosstab export without escaping or parameter binding. PostgreSQL identifier and literal boundaries are not enforced, so injected quote characters and statement terminators are interpreted as syntax. The server-side authorization model treats asset naming as a low-privilege operation, which widens the population of users capable of triggering the sink.
Attack Vector
Exploitation requires an authenticated session with asset creation or rename privileges. The attacker sets an asset display name that contains a SQL payload, then invokes the datapoint crosstab export for that asset or a dataset that includes it. The exported CSV contains the results of the injected query. No user interaction beyond the attacker's own session is required, and the attack traverses the network to reach the OpenRemote HTTP interface.
See the GitHub Security Advisory and the VulnCheck SQL Injection Advisory for additional technical detail.
Detection Methods for CVE-2026-62238
Indicators of Compromise
- Asset display names containing SQL metacharacters such as single quotes, double dashes, semicolons, or UNION SELECT fragments.
- HTTP requests to the datapoint crosstab export endpoint returning unusually large CSV payloads or containing column data not present in normal exports.
- PostgreSQL logs showing syntax errors or unexpected UNION, SELECT, or pg_catalog references originating from the OpenRemote application user.
- Recent asset rename events immediately followed by crosstab export requests from the same user session.
Detection Strategies
- Inspect application and database logs for query fragments that include asset name values with SQL syntax patterns.
- Alert on authenticated users performing asset renames followed by CSV export operations within short time windows.
- Baseline normal crosstab export response sizes and flag statistical outliers for review.
Monitoring Recommendations
- Enable PostgreSQL statement logging for the OpenRemote database role and forward events to a centralized log platform.
- Track privilege assignments granting asset creation or rename rights and review them against least-privilege policy.
- Monitor egress volume from the OpenRemote host for anomalous CSV download activity.
How to Mitigate CVE-2026-62238
Immediate Actions Required
- Upgrade OpenRemote to version 1.26.0 or later, which addresses the unsafe query construction in the crosstab export path.
- Audit existing asset names for embedded SQL syntax and remediate any suspicious entries before upgrading.
- Review accounts holding asset creation or rename permissions and revoke access that is not operationally required.
- Rotate database credentials and any secrets stored in the OpenRemote database if exploitation is suspected.
Patch Information
The fix is delivered in OpenRemote 1.26.0. Refer to the GitHub Security Advisory GHSA-cgfv-jrfp-2r7v for the vendor's remediation guidance and commit references.
Workarounds
- Restrict asset creation and rename permissions to a minimal set of trusted administrative accounts until the upgrade is applied.
- Disable or block network access to the datapoint crosstab export endpoint through reverse proxy rules where the feature is not required.
- Apply input validation at a proxy layer to reject asset name payloads containing SQL metacharacters as a temporary control.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
