Innowise engineers credited with discovering two open-source security vulnerabilities

A great achievement from our engineering team: Tolqin Urinbaev and Vladyslav Koniakhin have been officially credited with discovering and reporting two vulnerabilities in open-source software: CVE-2026-36826, affecting genesisQL, and CVE-2026-56784, affecting OpenRemote Manager.

Both findings have received CVE identifiers, which means they’re now part of the international system used by security teams, software vendors, and vulnerability management tools to track publicly disclosed cybersecurity issues. The OpenRemote vulnerability is also listed in the National Vulnerability Database maintained by the US National Institute of Standards and Technology.

CVE-2026-36826: SQL injection in genesisQL

The first vulnerability was found in genesisQL, an open-source tool developed by Open Source Labs.

The issue was in the application’s checkPassword function. User-supplied usernames and passwords were inserted directly into an SQL query instead of being processed through parameterized queries or prepared statements.

That opened the door to an SQL injection attack. In practice, an unauthenticated remote attacker could manipulate the login query and potentially bypass authentication.

The vulnerability affects genesisQL version 1.1.1 and possibly earlier versions. It is categorized as CWE-89: Improper Neutralization of Special Elements Used in an SQL Command.

The recommended fix is to replace direct string interpolation with parameterized queries or prepared statements so that user input stays separate from executable SQL commands.

CVE-2026-56784: cross-tenant authorization bypass in OpenRemote

The second vulnerability was discovered in OpenRemote Manager, an open-source platform for building and managing IoT applications.

OpenRemote separates customers and environments into individual realms, or tenants. However, its bulk alarm deletion endpoint didn’t properly check whether the alarms selected for deletion actually belonged to the authenticated user’s realm.

Because of that, a user with alarm-writing permissions in one tenant could submit arbitrary alarm IDs and permanently delete alarms belonging to another tenant.

The IDs were also sequential, which meant they could potentially be enumerated. This could expose the existence of alarm records across tenants and allow attackers to delete operational, security, or safety-related alerts.

The vulnerability is classified as an insecure direct object reference, or IDOR, under CWE-639: Authorization Bypass Through User-Controlled Key. It could be exploited remotely by an authenticated user with relatively limited permissions and received a high-severity CVSS 4.0 score of 8.6 in the published CVE record.

The issue was addressed in OpenRemote 1.25.0, where realm-level validation was added to the affected bulk deletion workflow.

What a CVE record means

CVE stands for Common Vulnerabilities and Exposures. The CVE Program assigns standardized identifiers to publicly disclosed vulnerabilities so that researchers, software vendors, security teams, and automated tools can all refer to the same issue consistently.

Researchers need to inspect the application’s code and behavior, identify a genuine security weakness, confirm its possible impact, collect evidence, and report the issue through the appropriate responsible disclosure process.

Once published, the CVE record can be used in security advisories, vulnerability scanners, dependency monitoring tools, patch-management systems, and public databases such as NIST’s National Vulnerability Database.

A strong addition to our security expertise

Finding vulnerabilities in established open-source projects takes a deep understanding of secure software development, authorization models, database security, source-code analysis, and real-world attack techniques.

Tolqin and Vladyslav’s recognition in the published vulnerability records is a great example of the security expertise we have within the Innowise engineering team. It also reflects our commitment to responsible disclosure and to making the open-source ecosystem safer for everyone who relies on it.

Congratulations to Tolqin Urinbaev and Vladyslav Koniakhin on this achievement and on their contribution to the global cybersecurity community.