Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H L L 7.2 .0033 26.4 —
AFFECTED Product Versions Fixed openremote unspecified 1.26.0
TIMELINE Jul 13 Reserved by VulnCheck Jul 17 EXPLOIT PUBLISHED — CVE-2026-62238 (openremote). Public exploit reference added. Jul 17 Published (CNA: VulnCheck)
OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV response, enabling database data exfiltration.
| Date | Event | Detail |
|---|---|---|
| July 13, 2026 | Reserved | Reserved by VulnCheck |
| July 17, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-62238 (openremote). Public exploit reference added. |
| July 17, 2026 | Published | Published (CNA: VulnCheck) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| openremote | openremote | — | — | 1.26.0 |
Authoritative record: CVE-2026-62238 at cve.org
Vendors: openremote
Weaknesses: CWE-89
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-62238 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.