CVE-2026-18801
OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is subsequently used in a meter or event query, OpenMeter inserts the stored value into a ClickHouse WITH map(...) expression using string concatenation. OpenMeter versions from v1.0.0-beta.218 through v1.0.0-beta.231 are affected.
- Score
- CVSS 4.0 9.3 Critical
- Status
- Awaiting Analysis - 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
- Published
- 2026-08-04
- Last modified
- 2026-08-04
- Weaknesses
- CWE-20
Affected products
References
- https://github.com/openmeterio/openmeter/security/advisories/GHSA-m2fw-9wxq-jgf5
