Paper/Archive/CVE-2026-18801

CVE-2026-18801

openmeter openmeter — Stored Clickhouse SQL Injection Through Customer Usage Attribution

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 32.7.327 × 206.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is subsequently used in a meter or event query, OpenMeter inserts the stored value into a ClickHouse WITH map(...) expression using string concatenation. OpenMeter versions from v1.0.0-beta.218 through v1.0.0-beta.231 are affected.

Affected

ProductAffectedFixed inSource

openmeterv1.0.0-beta.218 – v1.0.0-beta.231–CNA

Scores by source

Kong (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/openmeterio/openmeter/security/advisories/GHSA-m2fw-9wxq-jgf5