CVE-2026-8462

OpenMeter before v1.0.0-beta.228 fails to safely handle user-controlled JSONPath values in meter definitions backed by ClickHouse, resulting in SQL injection (CWE-89). A remote, unauthenticated attacker can submit crafted JSONPath expressions to the meters API, causing them to be incorporated into ClickHouse queries. Successful exploitation allows the attacker to read or modify metering event data and can potentially disrupt the service, leading to denial of service. All deployments of OpenMeter earlier than v1.0.0-beta.228 on any platform are affected, with self-hosted instances of this open-source usage-metering platform being the primary exposure. No public proof-of-concept is known, the issue is not listed in CISA's KEV, and there are no confirmed reports of exploitation so far.

What to do: Upgrade OpenMeter to v1.0.0-beta.228 or later as soon as possible. If an immediate upgrade is not possible, restrict network access to the meters API (e.g., place it behind an authenticating reverse proxy or limit it to trusted networks). Afterwards, review ClickHouse logs and metering event data for signs of unauthorized access or modification.