An unauthenticated SQL injection vulnerability in OpenMeter versions prior to 1.0.0-beta.228 poses a critical risk to data integrity and service availability.

This vulnerability is an SQL injection (CWE-89) affecting ClickHouse-backed meter definitions. It allows an unauthenticated attacker to inject malicious JSONPath values into the meters API to modify or access backend metering data.

The ability for an unauthenticated attacker to execute arbitrary SQL commands against the database presents a severe risk to business operations. This flaw could lead to the unauthorized modification or exfiltration of sensitive metering event data, as well as service disruption via a denial of service attack. With a CVSS score of 8.9, this vulnerability is classified as high severity and requires immediate attention to prevent potential data compromise.

Immediate Action: Update OpenMeter to version 1.0.0-beta.228 or later to incorporate the necessary input sanitization fixes.

Proactive Monitoring: Review database access logs for unusual queries or patterns originating from the meters API, particularly those containing JSONPath syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious SQL injection payloads targeting JSONPath parameters.

Public Exploit Available: No (exploit_available: unknown)

Given the high CVSS score and the potential for total impact on metering data, organizations must prioritize patching this vulnerability. Administrators should verify their current version of OpenMeter and apply the 1.0.0-beta.228 update immediately to eliminate the exposure. Continuous monitoring of database logs is advised until the patch is successfully deployed across all instances.