CVE-2026-63224

Prior to version 1.26.0 , the OpenRemote IoT platform is vulnerable to SQL injection within its datapoint export API. The root cause is the unsafe concatenation of asset name and attribute name into a COPY query using crosstab. Because the asset name is used in both a double-quoted column identif...