GHSA-cgfv-jrfp-2r7v: OpenRemote has Authenticated SQL Injection via Datapoint Crosstab Export

The datapoint export API builds a PostgreSQL crosstab export query by concatenating asset display names into raw SQL. An authenticated user who can create or rename an asset and then request a crosstab datapoint export can inject SQL through the asset name. The injected query output is streamed back to the caller inside the normal ZIP/CSV export response.

This creates a practical database exfiltration primitive through the application API. In a multi-tenant deployment, this can expose data outside the attacker’s tenant if the application database role can read shared manager tables.