CVE-2026-8462

Name of the Vulnerable Software and Affected Versions OpenMeter (affected versions not specified)

Description An authenticated tenant can perform SQL injection through the valueProperty or groupBy fields of the 'POST /api/v1/meters' endpoint. The issue occurs because the application uses string interpolation via fmt.Sprintf to build ClickHouse queries instead of using parameterized queries. Specifically, the sqlbuilder.Escape() function fails to escape single quotes, allowing an attacker to close the string literal and execute arbitrary SQL commands. Since the shared ClickHouse database lacks row-level security, a successful exploit allows an authenticated tenant to read or write metering data belonging to any other tenant, or potentially cause a denial of service through resource-exhausting queries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.