---
id: "CVE-2026-63224"
kind: "vulnerability"
aliases: ["CVE-2026-63224"]
title: "OpenRemote: asset names inject SQL into CSV datapoint exports"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["iot", "openremote", "other", "self-hosted"]
not_affected_if: ["no-authenticated-user-access", "version-1.26.0-or-later"]
published_at: "2026-10-30T22:16:58+00:00"
first_seen_at: "2026-10-30T22:25:57+00:00"
updated_at: "2026-10-30T22:27:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63224", "first_seen_at": "2026-10-30T22:25:57+00:00"}]
---

# OpenRemote: asset names inject SQL into CSV datapoint exports

OpenRemote, an open-source IoT platform, builds a crosstab export query by concatenating asset and attribute names into SQL without proper escaping. An authenticated user who can create or rename an asset can inject SQL and read database contents returned inside the normal CSV export.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenRemote version in use; versions before `1.26.0` are affected per the description.
- Identify whether users can create or rename assets and export datapoints in your deployment.
- In multi-tenant deployments, check whether the manager's database role can read tables shared across tenants.

## Fix

- OpenRemote: upgrade to `1.26.0`.

## Timeline

- 2026-10-30T22:25:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63224

## From the sources

OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the `datapoint export` API constructs `CSV crosstab` SQL by concatenating an `asset name` and `attribute name` into a `COPY` query that uses `crosstab` and streams `TO STDOUT`. The `asset name` enters both a double-quoted column identifier and a category query enclosed by the fixed `$cat$` delimiter. Escaping single quotes in one string context does not escape embedded double quotes in identifiers or protect that dollar-quote boundary. An authenticated user permitted to create or rename an asset and read/export datapoints for one of its attributes can store SQL metacharacters in the name and request a `crosstab` export, causing injected SELECT output to be returned in the normal ZIP/CSV response. This enables database exfiltration without direct database or filesystem access or token forgery. In a multi-tenant deployment it can expose other tenants' data if the manager's database role can read shared tables; integrity and availability effects are not established by the demonstrated read primitive. This issue is fixed in version 1.26.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_