CVE-2026-63224: 
Java vulnerability analysis and mitigation

CVE-2026-63224 is an authenticated SQL injection vulnerability in OpenRemote's datapoint crosstab export functionality, allowing an authenticated attacker to inject arbitrary SQL through asset display names embedded in raw PostgreSQL queries. It affects io.openremote:openremote-manager versions prior to 1.26.0 (specifically identified as affecting version 1.25.0). The vulnerability was published on June 30, 2026, and patched in version 1.26.0. It carries a CVSS v4 base score of 7.2 (High) (GitHub Advisory, OpenRemote Advisory).

The root cause (CWE-89) is manual SQL string construction that embeds user-controlled asset display names directly into executable PostgreSQL SQL without adequate escaping. Specifically, the AssetDatapointService.java builds a COPY (SELECT * FROM crosstab(...)) TO STDOUT query by concatenating the asset name into two SQL contexts: a double-quoted column identifier (e.g., "AssetName : attr" text) and a category query string wrapped in a fixed dollar-quote delimiter ($cat$...$cat$). Single quotes are partially escaped in one context, but double quotes in asset names are not escaped before use as SQL identifiers, and the fixed dollar-quote delimiter ($cat$) is not protected against asset names containing that token. An attacker can craft an asset name with SQL metacharacters to break out of the intended grammar boundary and append arbitrary SQL to the COPY ... TO STDOUT statement, with injected query output streamed back in the ZIP/CSV export response (OpenRemote Advisory, Fix Commit).

Successful exploitation enables a remote authenticated attacker to exfiltrate arbitrary data from the PostgreSQL database accessible to the application's database role, including data from other tenants in multi-tenant deployments. The demonstrated proof-of-concept retrieved current_user, current_database(), and aggregate table counts via injected SQL returned in the normal CSV export response. Depending on the database role's privileges, integrity and availability impacts (e.g., data modification or deletion) are also possible, though the primary demonstrated impact is high-confidentiality data exfiltration (OpenRemote Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the advisory date. The vulnerability requires a valid authenticated session with permissions to create or rename assets and export datapoints in crosstab format — no direct database access, filesystem access, or token forgery is needed. The attack complexity is low once authenticated, and the injected results are returned directly in the normal application API response. The CVE is newly disclosed (June–July 2026) and does not appear in the CISA KEV catalog; no EPSS score is currently available (OpenRemote Advisory, GitHub Advisory).

1. Authenticate: Obtain a valid session on the OpenRemote instance (version < 1.26.0) with an account that has asset read/write and datapoint export permissions.
2. Create or rename an asset: Set the asset's display name to a string containing SQL metacharacters that break out of the crosstab column definition or dollar-quote delimiter, for example: legit') UNION SELECT current_user, current_database(), count(*)::text FROM asset-- or a name containing $cat$ to close the dollar-quote boundary.
3. Add a datapoint: Ensure the crafted asset has at least one exportable attribute with at least one datapoint value written to it.
4. Trigger crosstab export: Send an authenticated HTTP request to the datapoint export API endpoint requesting CSV_CROSSTAB or CSV_CROSSTAB_MINUTE format for the crafted asset's attribute, specifying a valid time range.
5. Retrieve injected output: Download and unzip the returned ZIP file. Inspect the CSV — it will contain both normal datapoint rows and additional rows produced by the injected SQL query, effectively exfiltrating database content (e.g., current_user, current_database(), table counts, or other table data accessible to the application DB role) (OpenRemote Advisory).

• Network: Authenticated API requests to the datapoint export endpoint requesting CSV_CROSSTAB or CSV_CROSSTAB_MINUTE format with unusual asset IDs; repeated export requests from a single user account in a short timeframe.
• Logs: Application logs showing asset rename or creation events followed immediately by crosstab export requests for the same asset; PostgreSQL query logs (if enabled) containing unexpected SQL fragments such as UNION SELECT, current_user, current_database(), or $cat$ within COPY ... TO STDOUT statements.
• File System: Downloaded ZIP/CSV export files containing extra rows beyond expected datapoint data, particularly rows with database metadata values (e.g., database usernames, database names, or row counts from unrelated tables).
• Application Behavior: Asset names in the OpenRemote UI containing SQL metacharacters such as ", ', $cat$, --, or UNION SELECT patterns (OpenRemote Advisory).

Upgrade io.openremote:openremote-manager to version 1.26.0 or later, which resolves the vulnerability by replacing user-controlled asset names in SQL with generated internal column keys (e.g., col_0, col_1) and applying asset display labels only during application-side CSV header serialization — entirely removing user input from SQL syntax. No configuration-based workaround is documented; the recommended action is to upgrade immediately. As a defense-in-depth measure, restrict asset creation/rename and datapoint export permissions to trusted users until the patch is applied (Fix Commit, OpenRemote Advisory).