CVE-2026-63224
Deferred Deferred - Pending Action

SQL Injection in OpenRemote via Asset Name

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description
OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the `datapoint export` API constructs `CSV crosstab` SQL by concatenating an `asset name` and `attribute name` into a `COPY` query that uses `crosstab` and streams `TO STDOUT`. The `asset name` enters both a double-quoted column identifier and a category query enclosed by the fixed `$cat$` delimiter. Escaping single quotes in one string context does not escape embedded double quotes in identifiers or protect that dollar-quote boundary. An authenticated user permitted to create or rename an asset and read/export datapoints for one of its attributes can store SQL metacharacters in the name and request a `crosstab` export, causing injected SELECT output to be returned in the normal ZIP/CSV response. This enables database exfiltration without direct database or filesystem access or token forgery. In a multi-tenant deployment it can expose other tenants' data if the manager's database role can read shared tables; integrity and availability effects are not established by the demonstrated read primitive. This issue is fixed in version 1.26.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-63224

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openremote openremote < 1.26.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in OpenRemote versions prior to 1.26.0. It involves an SQL injection flaw in the 'datapoint export' API where asset and attribute names are improperly concatenated into a CSV crosstab SQL query. An authenticated user with asset creation/rename and datapoint read permissions can inject SQL metacharacters into asset names to manipulate the query, enabling database exfiltration without direct database access or token forgery.

Detection Guidance

To detect this vulnerability, check if your OpenRemote instance is running a version prior to 1.26.0. Review asset and attribute names for unusual characters or SQL metacharacters. Monitor for unexpected CSV or ZIP exports containing database data not related to the requested asset.

Impact Analysis

An attacker with limited privileges could exfiltrate sensitive database data through crafted asset names. In multi-tenant deployments, this could expose other tenants' data if the database role has access to shared tables. The impact is primarily data confidentiality breaches without affecting system integrity or availability.

Compliance Impact

This vulnerability could lead to unauthorized data access, potentially violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using affected OpenRemote versions may face compliance violations, regulatory penalties, and loss of customer trust due to potential data breaches.

Mitigation Strategies

Upgrade OpenRemote to version 1.26.0 or later immediately. Review and restrict user permissions to prevent unauthorized asset creation or renaming. Audit existing asset and attribute names for suspicious entries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63224. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart