Live › vulnerability › CVE-2026-63224
OpenRemote, an open-source IoT platform, builds a crosstab export query by concatenating asset and attribute names into SQL without proper escaping. An authenticated user who can create or rename an asset can inject SQL and read database contents returned inside the normal CSV export.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 22:25 UTC. All times on this page are UTC.
Teams running OpenRemote before 1.26.0 where users can create or rename assets and export datapoints. Multi-tenant deployments are most at risk because the database role may expose other tenants' data. Installations on 1.26.0 or later are not affected.
No product ranges from the sources yet.
1.26.0 are affected per the description.1.26.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the datapoint export API constructs CSV crosstab SQL by concatenating an asset name and attribute name into a COPY query that uses crosstab and streams TO STDOUT. The asset name enters both a double-quoted column identifier and a category query enclosed by the fixed $cat$ delimiter. Escaping single quotes in one string context does not escape embedded double quotes in identifiers or protect that dollar-quote boundary. An authenticated user permitted to create or rename an asset and read/export datapoints for one of its attributes can store SQL metacharacters in the name and request a crosstab export, causing injected SELECT output to be returned in the normal ZIP/CSV response. This enables database exfiltration without direct database or filesystem access or token forgery. In a multi-tenant deployment it can expose other tenants' data if the manager's database role can read shared tables; integrity and availability effects are not established by the demonstrated read primitive. This issue is fixed in version 1.26.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-63224")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.