Authenticated users who can create or rename assets can inject SQL metacharacters into asset names. The application concatenates these names into a crosstab SQL statement, causing the injected SELECT statements to execute and return data in the standard ZIP/CSV response. This allows targeted database exfiltration without direct database or filesystem access or token forgery.

OpenRemote platforms running any 1.x release prior to 1.26.0 are affected. The vulnerability impacts all deployments that rely on the datapoint export API, including multi‑tenant installations where the database role of the manager has read access to shared tables. The platform is distributed under the openremote:openremote suite.

The CVSS score of 7.2 indicates a significant risk, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session with permissions to create or rename assets; the attacker can then request a crosstab export to receive arbitrary data exported from the database. The vulnerability is only a read‑only data exfiltration under the currently demonstrated technique, but it could expand if additional privileges are granted.