The vulnerability in OpenRemote prior to version 1.26.0 is an authenticated SQL injection (CWE-89) in the datapoint crosstab export endpoint. The issue occurs because asset display names are concatenated into PostgreSQL queries without proper sanitization. An attacker who is authenticated and has permissions to create or rename assets can inject malicious SQL code through the asset name parameter. This injection allows the attacker to execute arbitrary SQL queries and receive the results in the exported CSV, enabling exfiltration of sensitive database information. There is no indication of known exploits in the wild, and no patch or official fix information is provided in the data.

Successful exploitation allows an authenticated attacker with asset creation or rename permissions to perform SQL injection, leading to unauthorized access and exfiltration of database data via the CSV export functionality. This compromises the confidentiality of the database contents. The vulnerability requires authentication and specific permissions, limiting the attack surface to authorized users with elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict asset creation and rename permissions to trusted users only to reduce the risk of exploitation. Monitor for vendor updates regarding patches or official mitigations.