Executive brief
OpenRemote, an open-source IoT device management platform, contains a security flaw in its data export feature. An authorized user can manipulate asset names to execute unauthorized database commands when exporting data to a CSV file. This could allow an attacker to steal sensitive information from the underlying database, potentially including data belonging to other organizations in a shared hosting environment.
Technical details
An authenticated SQL injection vulnerability exists in OpenRemote's datapoint crosstab export endpoint due to improper neutralization of asset display names. The application constructs PostgreSQL queries by concatenating these user-controlled names directly into raw SQL identifiers and category queries within a 'crosstab(...)' function. An attacker with permissions to create or rename assets can inject SQL commands that break out of the quoted identifier or dollar-quoted string boundaries. The results of the injected query are then streamed back to the attacker within the generated CSV export. This flaw is particularly critical in multi-tenant deployments as it may allow cross-tenant data exfiltration if the database role has sufficient privileges. The issue is resolved in version 1.26.0.
Affected products
- OpenRemote OpenRemote < 1.26.0
Timeline
- 2026-06-30: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: NVD and VulnCheck publication
- 2026-07-17: other: CVE record published