PT-2026-134235
CVE-2026-63224
·
Published
2026-10-30
·
Updated
2026-10-30
Description by
CVSS 4.0
7.2
HighMetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
OpenRemote versions prior to 1.26.0
Description
The
datapoint export API constructs SQL for CSV crosstab by concatenating an asset name and attribute name into a COPY query. Because escaping single quotes does not protect double-quoted identifiers or the $cat$ dollar-quote boundary, an authenticated user with permissions to create or rename assets and export datapoints can inject SQL metacharacters into the name. This allows the user to execute injected SELECT statements and receive the output in the ZIP/CSV response, enabling database exfiltration. In multi-tenant environments, this may expose data from other tenants if the manager's database role has access to shared tables.Recommendations
Update to version 1.26.0.
Found an issue in the description? Have something to add? Feel free to write us 👾