{"id":"CVE-2026-8462","summary":"OpenMeter SQL Injection in ClickHouse-backed Meter Definitions","details":"SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to meters API.","aliases":["GHSA-wc3v-3457-c8cm","GO-2026-5703"],"modified":"2026-09-18T03:48:33.420136595Z","published":"2026-09-16T10:14:34.372Z","related":["openSUSE-SU-2026:21483-1"],"database_specific":{"cna_assigner":"Kong","cwe_ids":["CWE-89"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8462.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8462.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8462"},{"type":"FIX","url":"https://github.com/openmeterio/openmeter/pull/4383"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openmeterio/openmeter","events":[{"introduced":"0"},{"fixed":"6ce29e743165890c10346f4c71d5bf79f1ecaf6f"}],"database_specific":{"extracted_events":[{"introduced":"1.0.0"},{"fixed":"1.0.0-beta.228"},{"introduced":"0"},{"fixed":"v1.0.0-beta.228"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["v1.0.0-beta.227","v1.0.0-beta.226","v1.0.0-beta.225","v1.0.0-beta.224","v1.0.0-beta.223","v1.0.0-beta.222","v1.0.0-beta.221","v1.0.0-beta.220","v1.0.0-beta.219","v1.0.0-beta.218","v1.0.0-beta.217","v1.0.0-beta.216","v1.0.0-beta.215","v1.0.0-beta.214","v1.0.0-beta.213","v1.0.0-beta.212","v1.0.0-beta.211","v1.0.0-beta.210","v1.0.0-beta.209","v1.0.0-beta.208","v1.0.0-beta.207","v1.0.0-beta.206","v1.0.0-beta.205","v1.0.0-beta.204","v1.0.0-beta.203","v1.0.0-beta.202","v1.0.0-beta.201","v1.0.0-beta.200","v1.0.0-beta.199","v1.0.0-beta.198","v1.0.0-beta.197","v1.0.0-beta.196","v1.0.0-beta.195","v1.0.0-beta.194","v1.0.0-beta.193","v1.0.0-beta.192","v1.0.0-beta.191","v1.0.0-beta.190","v1.0.0-beta.189","v1.0.0-beta.188","v1.0.0-beta.187","v1.0.0-beta.186","v1.0.0-beta.185","v1.0.0-beta.184","v1.0.0-beta.183","v1.0.0-beta.182","v1.0.0-beta.181","v1.0.0-beta.180","v1.0.0-beta.179","v1.0.0-beta.178","v1.0.0-beta.176","v1.0.0-beta.177","v1.0.0-beta.175","v1.0.0-beta.174","v1.0.0-beta.173","v1.0.0-beta.172","v1.0.0-beta.171","v1.0.0-beta.170","v1.0.0-beta.169","v1.0.0-beta.168","v1.0.0-beta.167","v1.0.0-beta.166","v1.0.0-beta.165","v1.0.0-beta.164","v1.0.0-beta.163","v1.0.0-beta.162","v1.0.0-beta.161","v1.0.0-beta.160","v1.0.0-beta.159","v1.0.0-beta.158","v1.0.0-beta.157","v1.0.0-beta.156","v1.0.0-beta.155","v1.0.0-beta.154","v1.0.0-beta.153","v1.0.0-beta.152","v1.0.0-beta.151","v1.0.0-beta.150","v1.0.0-beta.149","v1.0.0-beta.148","v1.0.0-beta.147","v1.0.0-beta.146","v1.0.0-beta.145","v1.0.0-beta.144","v1.0.0-beta.143","v1.0.0-beta.142","v1.0.0-beta.141","v1.0.0-beta.139","v1.0.0-beta.140","v1.0.0-beta.136","v1.0.0-beta.138","v1.0.0-beta.137","v1.0.0-beta.135","v1.0.0-beta.134","v1.0.0-beta.133","v1.0.0-beta.132","v1.0.0-beta.131","v1.0.0-beta.130","v1.0.0-beta.129","v1.0.0-beta.128","v1.0.0-beta.127","v1.0.0-beta.126","v1.0.0-beta.125","v1.0.0-beta.124","v1.0.0-beta.123","v1.0.0-beta.122","v1.0.0-beta.121","v1.0.0-beta.120","v1.0.0-beta.119","v1.0.0-beta.118","v1.0.0-beta.117","v1.0.0-beta.116","v1.0.0-beta.115","v1.0.0-beta.114","v1.0.0-beta.113","v1.0.0-beta.112","v1.0.0-beta.111","v1.0.0-beta.110","v1.0.0-beta.109","v1.0.0-beta.108","v1.0.0-beta.107","v1.0.0-beta.106","v1.0.0-beta.105","v1.0.0-beta.104","v1.0.0-beta.103","v1.0.0-beta.102","v1.0.0-beta.101","v1.0.0-beta.100","v1.0.0-beta.99","v1.0.0-beta.98","v1.0.0-beta.97","v1.0.0-beta.96","v1.0.0-beta.95","v1.0.0-beta.94","v1.0.0-beta.93","v1.0.0-beta.92","v1.0.0-beta.91","v1.0.0-beta.90","v1.0.0-beta.89","v1.0.0-beta.88","v1.0.0-beta.87","v1.0.0-beta.86","v1.0.0-beta.85","v1.0.0-beta.84","v1.0.0-beta.83","v1.0.0-beta.82","v1.0.0-beta.81","v1.0.0-beta.80","v1.0.0-beta.79","v1.0.0-beta.78","v1.0.0-beta.77","v1.0.0-beta.76","v1.0.0-beta.75","v1.0.0-beta.74","v1.0.0-beta.73","v1.0.0-beta.72","v1.0.0-beta.71","v1.0.0-beta.70","v1.0.0-beta.69","v1.0.0-beta.68","v1.0.0-beta.67","v1.0.0-beta.66","v1.0.0-beta.65","v1.0.0-beta.64","v1.0.0-beta.63","v1.0.0-beta.62","v1.0.0-beta.61","v1.0.0-beta.60","v1.0.0-beta.59","v1.0.0-beta.58","v1.0.0-beta.57","v1.0.0-beta.56","v1.0.0-beta.55","v1.0.0-beta.54","v1.0.0-beta.53","v1.0.0-beta.52","v1.0.0-beta.51","v1.0.0-beta.50","v1.0.0-beta.49","v1.0.0-beta.48","v1.0.0-beta.47","v1.0.0-beta.46","v1.0.0-beta.45","v1.0.0-beta.44","v1.0.0-beta.43","v1.0.0-beta.42","v1.0.0-beta.41","v1.0.0-beta.40","v1.0.0-beta.39","v1.0.0-beta.38","v1.0.0-beta.37","v1.0.0-beta.36","v1.0.0-beta.35","v1.0.0-beta.34","v1.0.0-beta.33","v1.0.0-beta.32","v1.0.0-beta.31","v1.0.0-beta.30","v1.0.0-beta.29","v1.0.0-beta.28","v1.0.0-beta.27","v1.0.0-beta.26","v1.0.0-beta.25","v1.0.0-beta.24","v1.0.0-beta.23","v1.0.0-beta.22","v1.0.0-beta.21","v1.0.0-beta.20","v1.0.0-beta.19","v1.0.0-beta.18","v1.0.0-beta.17","v1.0.0-beta.16","v1.0.0-beta.15","v1.0.0-beta.14","v1.0.0-beta.13","v1.0.0-beta.12","v1.0.0-beta.11","v1.0.0-beta.10","v1.0.0-beta.9","v1.0.0-beta.8","v1.0.0-beta.7","v1.0.0-beta.6","v0.3.0-beta.9","v0.3.0-beta.8","v0.3.0-beta.7","v0.3.0-beta.6","v0.3.0-beta.5","v0.3.0-beta.4","v0.3.0-beta.3","v0.3.0-beta.2","v0.3.0-beta.1","v0.2.0","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8462.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"}]}