Executive brief
OpenMeter is an open-source usage metering platform used to track and bill for product usage. A vulnerability in the meter creation process allows an authenticated user to execute unauthorized database commands. This could allow one customer (tenant) to view or modify the private usage data of other customers, potentially leading to data breaches or service disruptions.
Technical details
A SQL injection vulnerability exists in OpenMeter's ClickHouse streaming component due to improper neutralization of user-supplied JSONPath strings. In `openmeter/streaming/clickhouse/utils_query.go`, the application uses `fmt.Sprintf` to interpolate the `valueProperty` or `groupBy` fields into a `JSON_VALUE` function call. While the code attempts to use `sqlbuilder.Escape()`, this function only escapes dollar signs and fails to neutralize single quotes. An attacker with a valid tenant API key can provide a crafted JSONPath (e.g., using a `UNION ALL` clause) to bypass validation and execute arbitrary SQL against the shared `om_events` table. Because the database lacks row-level security, this allows for cross-tenant data exposure. The issue is fixed in version 1.0.0-beta.228 by using parameterized queries via `sb.Var()`.
Affected products
- OpenMeter OpenMeter < 1.0.0-beta.228
Timeline
- 2026-05-19: disclosed
- 2026-05-19: patched: Fixed in v1.0.0-beta.228
- 2026-06-04: advisory
References
- https://github.com/openmeterio/openmeter/security/advisories/GHSA-wc3v-3457-c8cm
- https://github.com/openmeterio/openmeter/pull/4383
- https://github.com/openmeterio/openmeter/commit/6ce29e743165890c10346f4c71d5bf79f1ecaf6f
- https://github.com/openmeterio/openmeter/releases/tag/v1.0.0-beta.228
- https://api.github.com/repos/openmeterio/openmeter/security-advisories/GHSA-wc3v-3457-c8cm