{"id":"CVE-2026-63224","state":"PUBLISHED","title":"OpenRemote has authenticated SQL injection in crosstab datapoint exports","description":"OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the `datapoint export` API constructs `CSV crosstab` SQL by concatenating an `asset name` and `attribute name` into a `COPY` query that uses `crosstab` and streams `TO STDOUT`. The `asset name` enters both a double-quoted column identifier and a category query enclosed by the fixed `$cat$` delimiter. Escaping single quotes in one string context does not escape embedded double quotes in identifiers or protect that dollar-quote boundary. An authenticated user permitted to create or rename an asset and read/export datapoints for one of its attributes can store SQL metacharacters in the name and request a `crosstab` export, causing injected SELECT output to be returned in the normal ZIP/CSV response. This enables database exfiltration without direct database or filesystem access or token forgery. In a multi-tenant deployment it can expose other tenants' data if the manager's database role can read shared tables; integrity and availability effects are not established by the demonstrated read primitive. This issue is fixed in version 1.26.0.","publishedAt":"2026-10-30T22:05:43.581Z","updatedAt":"2026-10-30T22:05:43.581Z","severity":{"score":7.2,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["openremote openremote"],"affected":[{"vendor":"openremote","product":"openremote","versions":[{"version":"< 1.26.0","status":"affected"}]}],"references":["https://github.com/openremote/core/security/advisories/GHSA-cgfv-jrfp-2r7v","https://github.com/openremote/core/commit/02ac83074b81617add814b2a72d459abdf374147","https://github.com/openremote/core/releases/tag/1.26.0"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-30T22:16:06.501Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/63xxx/CVE-2026-63224.json","commit":"226652b7321cd45ef01add6f464a8114b52515e5","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-63224","state":"PUBLISHED","datePublished":"2026-10-30T22:05:43.581Z","dateUpdated":"2026-10-30T22:05:43.581Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-07-15T22:19:06.907Z"},"containers":{"cna":{"title":"OpenRemote has authenticated SQL injection in crosstab datapoint exports","descriptions":[{"lang":"en","value":"OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the `datapoint export` API constructs `CSV crosstab` SQL by concatenating an `asset name` and `attribute name` into a `COPY` query that uses `crosstab` and streams `TO STDOUT`. The `asset name` enters both a double-quoted column identifier and a category query enclosed by the fixed `$cat$` delimiter. Escaping single quotes in one string context does not escape embedded double quotes in identifiers or protect that dollar-quote boundary. An authenticated user permitted to create or rename an asset and read/export datapoints for one of its attributes can store SQL metacharacters in the name and request a `crosstab` export, causing injected SELECT output to be returned in the normal ZIP/CSV response. This enables database exfiltration without direct database or filesystem access or token forgery. In a multi-tenant deployment it can expose other tenants' data if the manager's database role can read shared tables; integrity and availability effects are not established by the demonstrated read primitive. This issue is fixed in version 1.26.0."}],"affected":[{"vendor":"openremote","product":"openremote","versions":[{"version":"< 1.26.0","status":"affected"}]}],"references":[{"url":"https://github.com/openremote/core/security/advisories/GHSA-cgfv-jrfp-2r7v","name":"https://github.com/openremote/core/security/advisories/GHSA-cgfv-jrfp-2r7v","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/openremote/core/commit/02ac83074b81617add814b2a72d459abdf374147","name":"https://github.com/openremote/core/commit/02ac83074b81617add814b2a72d459abdf374147","tags":["x_refsource_MISC"]},{"url":"https://github.com/openremote/core/releases/tag/1.26.0","name":"https://github.com/openremote/core/releases/tag/1.26.0","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","version":"4.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","lang":"en","description":"CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-10-30T22:05:43.581Z"},"source":{"advisory":"GHSA-cgfv-jrfp-2r7v","discovery":"UNKNOWN"}}}}}