What is GHSA-rw7h-h988-gfff?

GHSA-rw7h-h988-gfff is a security advisory published by GitHub Security Advisories with High severity. OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint...

Which CVE IDs does GHSA-rw7h-h988-gfff cover?

GHSA-rw7h-h988-gfff covers the following CVE IDs: CVE-2026-62238. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-rw7h-h988-gfffHigh

OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint...

Vendor

GitHub Security Advisories

Published

July 17, 2026

Last Modified

July 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-62238 →

📋 Description

OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV response, enabling database data exfiltration.

🔗 References (4)

https://github.com/openremote/openremote/security/advisories/GHSA-cgfv-jrfp-2r7v
https://nvd.nist.gov/vuln/detail/CVE-2026-62238
https://www.vulncheck.com/advisories/openremote-sql-injection-via-crosstab-export
https://github.com/advisories/GHSA-rw7h-h988-gfff