CVE-2026-18801

Summary

OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values.

An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is subsequently used in a meter or event query, OpenMeter inserts the stored value into a ClickHouse WITH map(…) expression using string concatenation.

OpenMeter versions from v1.0.0-beta.218 through v1.0.0-beta.231 are affected.

Affected Software

Weaknesses

• CWE-20: CWE-20 Improper input validation

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: total

References

• https://github.com/openmeterio/openmeter/security/advisories/GHSA-m2fw-9wxq-jgf5

• ←Previous
• Next→