{"cve":"CVE-2026-62238","nvd":{"published":"2026-07-17T02:18:11.613","modified":"2026-10-24T13:10:00.147","status":"Analyzed","description":"OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV response, enabling database data exfiltration.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","score":7.2},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-89"],"references":["https://github.com/openremote/openremote/security/advisories/GHSA-cgfv-jrfp-2r7v","https://www.vulncheck.com/advisories/openremote-sql-injection-via-crosstab-export","https://github.com/openremote/openremote/security/advisories/GHSA-cgfv-jrfp-2r7v"],"products":["openremote:openremote"],"source":"nvd","synced_at":"2026-10-24T16:53:27.712498749+00:00"},"epss":{"cve":"CVE-2026-62238","score":0.00498,"percentile":0.42374,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-cgfv-jrfp-2r7v","url":"https://osv.dev/vulnerability/GHSA-cgfv-jrfp-2r7v","summary":"OpenRemote has Authenticated SQL Injection via Datapoint Crosstab Export","modified":"2026-07-18T03:56:42.499103992Z","packages":[{"ecosystem":"Maven","name":"io.openremote:openremote-manager","purl":"pkg:maven/io.openremote/openremote-manager","ranges":["<1.26.0"],"fixed":["1.26.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}