SQL Injection Vulnerability in OpenRemote IoT Platform
CVE-2026-63224

7.2HIGH

Key Information:

Vendor

Openremote

Status
Openremote
Vendor
CVE Published:
30 October 2026

What is CVE-2026-63224?

The OpenRemote platform has a vulnerability in its datapoint export API that allows an authenticated user to exploit SQL injection flaws. By manipulating asset and attribute names, an attacker can craft a request that results in sensitive data being exposed during the CSV export process. This issue affects users managing multi-tenant environments, as it could lead to unauthorized access to data from other tenants if the database role has the necessary permissions. The vulnerability has been addressed in version 1.26.0, where the SQL query construction problem was rectified, securing the API against such attacks.

Affected Version(s)

openremote < 1.26.0

References

https://github.com/openremote/core/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/openremote/core/commit/02ac83074b81617...
x_refsource_MISC
https://github.com/openremote/core/releases/tag/1.26.0
x_refsource_MISC

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.