CVE-2026-8462 OpenMeter SQL Injection in ClickHouse-backed Meter Definitions
Remote unauthenticated attackers can inject SQL via JSONPath values to access or modify metering data and cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-8462?
CVE-2026-8462 is a high-severity SQL injection vulnerability in openmeter, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to meters API.
Weakness: CWE-89
Which versions are affected by CVE-2026-8462?
3 open source packages ship an affected version, including github.com/openmeterio/openmeter.
| Package | Affected | Fixed in |
|---|---|---|
github.com/openmeterio/openmeter Go | All versions | 1.0.0-beta.228 |
github.com/openmeterio/openmeter Go | All versions | 1.0.0-beta.228 |
github.com/openmeterio/openmeter Go | All versions | 1.0.0-beta.228 |
How do I fix CVE-2026-8462?
Upgrade github.com/openmeterio/openmeter to 1.0.0-beta.228 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-8462 being exploited?
There is no known exploitation of CVE-2026-8462 in the wild and no public exploit code.
Sources
Also known as GHSA-wc3v-3457-c8cm, GO-2026-5703.