CVE-2026-8462

8.9 highEPSS 0.5%

High (8.9). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in github.com/openmeterio/openmeter 1.0.0-beta.228.

SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to meters API.

Severity

CVSS 4.0

8.9 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-09-16
Modified: 2026-09-18
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-wc3v-3457-c8cm	Go	github.com/openmeterio/openmeter	<1.0.0-beta.228	1.0.0-beta.228
GO-2026-5703	Go	github.com/openmeterio/openmeter	<1.0.0-beta.228	1.0.0-beta.228

References

https://github.com/openmeterio/openmeter/pull/4383

Check your stack JSON