high8.9
CVE-2026-8462
SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to…
Impact
SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to meters API.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/openmeterio/openmeter | < 1.0.0-beta.228 | 1.0.0-beta.228 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-wc3v-3457-c8cm
- https://github.com/openmeterio/openmeter/security/advisories/GHSA-wc3v-3457-c8cm
- https://github.com/openmeterio/openmeter/pull/4383
- https://github.com/openmeterio/openmeter/commit/6ce29e743165890c10346f4c71d5bf79f1ecaf6f
- https://github.com/openmeterio/openmeter/releases/tag/v1.0.0-beta.228