CVE-2026-8462

HighCVSS 8.9

Published: 16/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 16/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.60%

47th percentile - higher than 47% of all known CVEs

Summary

OpenMeter before v1.0.0-beta.228 contains an SQL injection vulnerability in ClickHouse-backed meter definitions. A remote unauthenticated attacker can access or modify metering event data and potentially cause denial of service.

Risk Assessment

Risk of confidentiality and integrity breach of metering data and service disruption.

Recommendation

Upgrade OpenMeter to version v1.0.0-beta.228 or later.

Other vulnerabilities in OpenMeter

CVE-2026-18801Critical
OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is subsequently used in a meter or event query, OpenMeter inserts the stored value into a ClickHouse WITH map(...) expression using string concatenation. OpenMeter versions from v1.0.0-beta.218 through v1.0.0-beta.231 are affected.

Original NVD description (English source)

SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to meters API.