CVE-2026-8462 Overview
CVE-2026-8462 is a SQL injection vulnerability in OpenMeter, an open-source usage metering and billing platform. The flaw resides in ClickHouse-backed meter definitions and stems from unsafe handling of user-controlled JSONPath values submitted to the meters API. A remote, unauthenticated attacker can inject SQL into ClickHouse queries by crafting malicious JSONPath input. Successful exploitation allows attackers to access or modify metering event data and potentially trigger denial of service against the underlying database. The vulnerability affects all OpenMeter releases before v1.0.0-beta.228 across all supported platforms. The weakness is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.
Critical Impact
Unauthenticated remote attackers can read, tamper with, or destroy metering event data stored in ClickHouse through crafted JSONPath payloads sent to the meters API.
Affected Products
- OpenMeter versions prior to v1.0.0-beta.228
- Deployments using ClickHouse-backed meter definitions
- All platforms and operating systems running affected OpenMeter builds
Discovery Timeline
- 2026-09-16 - CVE-2026-8462 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-8462
Vulnerability Analysis
OpenMeter uses ClickHouse as a backend to store and aggregate metering events. Meter definitions allow operators to specify JSONPath expressions that select fields from ingested event payloads. Before v1.0.0-beta.228, the meters API accepted user-controlled JSONPath values and interpolated them into generated ClickHouse SQL statements without sufficient neutralization. An attacker can escape the intended JSONPath context and inject arbitrary SQL clauses that ClickHouse then executes. Because the endpoint accepts unauthenticated requests over the network, exploitation requires no credentials, no user interaction, and low attack complexity.
Root Cause
The root cause is improper neutralization of special SQL characters in JSONPath fields supplied through the meters API. Meter definition logic concatenates or interpolates the untrusted JSONPath string into a dynamic ClickHouse query rather than passing it through a parameterized statement or a strict JSONPath validator. This mirrors classic [CWE-89] patterns, where the boundary between data and code collapses inside a query builder.
Attack Vector
An unauthenticated attacker sends a crafted HTTP request to the OpenMeter meters API endpoint responsible for creating or querying meter definitions. The request contains a JSONPath field whose value includes SQL syntax that terminates the intended expression and appends attacker-controlled ClickHouse operations. Downstream query construction embeds the payload into the SQL sent to ClickHouse, producing arbitrary reads, writes, or resource-intensive statements against metering data.
No verified proof-of-concept code has been published. Technical remediation details are available in the upstream fix at OpenMeter Pull Request #4383.
Detection Methods for CVE-2026-8462
Indicators of Compromise
- HTTP requests to OpenMeter meter definition or meter query endpoints containing SQL metacharacters such as ', --, ;, UNION, or SELECT inside JSONPath fields.
- ClickHouse query logs showing meter-related statements with unexpected clauses, subqueries, or references to system tables like system.tables or system.users.
- Unexplained modifications, deletions, or bulk reads of metering event rows in ClickHouse.
- Spikes in ClickHouse CPU or memory usage correlated with anomalous meter API traffic.
Detection Strategies
- Inspect application and reverse-proxy logs for requests to the meters API that include non-standard characters in valueProperty, groupBy, or other JSONPath parameters.
- Enable ClickHouse query_log and alert on meter-service queries that deviate from the known template shapes generated by OpenMeter.
- Correlate unauthenticated meter API access with database write or DDL operations that should not originate from that code path.
Monitoring Recommendations
- Forward OpenMeter application logs and ClickHouse query logs into a centralized analytics platform for retention and correlation.
- Baseline normal meter API request patterns and alert on deviations in payload structure, size, or source IP diversity.
- Monitor for repeated 4xx or 5xx responses from meter endpoints, which often accompany injection probing.
How to Mitigate CVE-2026-8462
Immediate Actions Required
- Upgrade OpenMeter to v1.0.0-beta.228 or later on all environments.
- Restrict network exposure of the OpenMeter API so it is not reachable from untrusted networks.
- Rotate any ClickHouse credentials used by OpenMeter if compromise is suspected and audit metering data integrity.
Patch Information
The issue is remediated in OpenMeter v1.0.0-beta.228. The upstream fix is tracked in OpenMeter Pull Request #4383, which introduces proper handling of JSONPath values before they are used in ClickHouse queries. Operators running self-hosted OpenMeter should rebuild container images from the patched release and redeploy.
Workarounds
- Place the OpenMeter meters API behind an authenticating reverse proxy or API gateway that enforces access control until patching is complete.
- Apply a web application firewall rule that blocks SQL metacharacters and ClickHouse keywords in JSONPath fields of meter API requests.
- Restrict the ClickHouse account used by OpenMeter to the minimum privileges required, denying DDL and cross-database access where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
