OpenMeter: SQL injection through meter creation

Summary An authenticated tenant can inject arbitrary SQL through the valueProperty or groupBy fields of POST /api/v1/meters. The injection passes the application's JSONPath validation check and executes against the shared ClickHouse database, which contains event data for all tenants with no...

CVE-2026-8462

creationtimestamp| type| source ---|---|--- 2026-05-19 13:45:24+00:00| published-proof-of-concept| https://github.com/openmeterio/openmeter/security/advisories/GHSA-wc3v-3457-c8cm...