High severityNVD Advisory· Published Sep 16, 2026· Updated Sep 18, 2026
CVE-2026-8462
CVE-2026-8462
Description
SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to meters API.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/openmeterio/openmeterGo | < 1.0.0-beta.228 | 1.0.0-beta.228 |
Affected products
2- osv-coordsRange: < 0.0.20260723T184607-160000.1.1
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-wc3v-3457-c8cmghsaADVISORY
- github.com/openmeterio/openmeter/commit/6ce29e743165890c10346f4c71d5bf79f1ecaf6fghsaWEB
- github.com/openmeterio/openmeter/pull/4383nvdWEB
- github.com/openmeterio/openmeter/releases/tag/v1.0.0-beta.228ghsaWEB
- github.com/openmeterio/openmeter/security/advisories/GHSA-wc3v-3457-c8cmghsaWEB
News mentions
0No linked articles in our index yet.