Executive brief
OpenRemote, an open-source IoT device management platform, is vulnerable to a security flaw in its data export feature. An authorized user can manipulate asset names to execute unauthorized database commands when exporting data to a CSV file. This could allow an attacker to steal sensitive information from the database, including data belonging to other organizations in a shared hosting environment.
Technical details
An authenticated SQL injection vulnerability exists in OpenRemote's datapoint export endpoint. The root cause is the manual construction of PostgreSQL queries where asset display names are concatenated directly into raw SQL identifiers and category queries within a 'crosstab' function. An attacker with permissions to create or rename assets can inject SQL commands via the asset name. When a crosstab export is requested, the backend executes the injected SQL and streams the results back to the attacker within the generated CSV/ZIP response. This allows for full database exfiltration, which is particularly critical in multi-tenant deployments where the application database role may have access to shared tables. The issue is fixed in version 1.26.0.
Affected products
- OpenRemote openremote-manager < 1.26.0
Timeline
- 2026-06-30: disclosed
- 2026-07-06: advisory
- 2026-07-06: patched: Fixed in version 1.26.0