HIGH 8.9 NVD

CVE-2026-8462

SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to

SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to meters API.

References

https://github.com/openmeterio/openmeter/pull/4383

Published: 2026-09-16 · Source: NVD · Feed updated: 2026-09-16

This high severity vulnerability with a CVSS score of 8.9 was published on 2026-09-16 via NVD.

vulnfeed aggregates 14391 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.