{"id":"CVE-2026-8462","published":"2026-09-16T11:17:11.327","lastModified":"2026-09-18T19:07:38.320","description":"SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to meters API.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/openmeterio/openmeter/pull/4383","tags":[]}],"exploitRefs":[{"url":"https://github.com/openmeterio/openmeter/pull/4383","tags":[]}],"hasPoc":true,"ai":null}