CVE-2026-62238: OpenRemote SQL injection in datapoint crosstab export

CVE-2026-62238 · Severity: medium · CVSS 4 · Published 2026-07-17

OpenRemote, an open-source IoT device management platform, contains a security flaw in its data export feature. An authorized user can manipulate asset names to execute unauthorized database commands when exporting data to a CSV file. This could allow an attacker to steal sensitive information from the underlying database, potentially including data belonging to other organizations in a shared hosting environment.

Technologies: io.openremote:openremote-manager (Maven), OpenRemote. Vendors: Maven, OpenRemote.

Quick answers

Is CVE-2026-62238 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-62238 being exploited in the wild.
How severe is CVE-2026-62238?
Medium severity, with a CVSS score of 4, published 17 July 2026.
Which products and versions are affected?
io.openremote:openremote-manager (Maven) ECOSYSTEM:introduced=0,fixed=1.26.0; OpenRemote < 1.26.0.
Is there a fix for CVE-2026-62238?
Yes. io.openremote:openremote-manager (Maven): upgrade to 1.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62238 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-62238?
Check whether you run io.openremote:openremote-manager (Maven) or OpenRemote at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.openremote:openremote-manager (Maven): upgrade to 1.26.0 or later
    # set io.openremote:openremote-manager to 1.26.0 in your pom.xml or build.gradle

Technical details

An authenticated SQL injection vulnerability exists in OpenRemote's datapoint crosstab export endpoint due to improper neutralization of asset display names. The application constructs PostgreSQL queries by concatenating these user-controlled names directly into raw SQL identifiers and category queries within a 'crosstab(...)' function. An attacker with permissions to create or rename assets can inject SQL commands that break out of the quoted identifier or dollar-quoted string boundaries. The results of the injected query are then streamed back to the attacker within the generated CSV export. This flaw is particularly critical in multi-tenant deployments as it may allow cross-tenant data exfiltration if the database role has sufficient privileges. The issue is resolved in version 1.26.0.

Affected products

  • OpenRemote OpenRemote < 1.26.0

Identifiers

  • CVE-2026-62238
  • GHSA-cgfv-jrfp-2r7v

Timeline

  • 2026-06-30: advisory: GitHub Security Advisory published
  • 2026-07-16: disclosed: NVD and VulnCheck publication
  • 2026-07-17: other: CVE record published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.