CVE-2026-18801
Received Received - Intake

Stored SQL Injection in OpenMeter Usage Attribution

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: Kong

Description
OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is subsequently used in a meter or event query, OpenMeter inserts the stored value into a ClickHouse WITH map(...) expression using string concatenation. OpenMeter versions from v1.0.0-beta.218 through v1.0.0-beta.231 are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-18801
EUVD
EUVD-2026-52725

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openmeter openmeter From 1.0.0-beta.218 (inc) to 1.0.0-beta.231 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenMeter has a stored SQL injection flaw where attackers can inject malicious SQL code via customer usage-attribution fields. This occurs when an attacker creates or updates a customer with harmful values in usageAttribution.key or usageAttribution.subjectKeys. Later, when that customer is used in queries, the system inserts these values directly into a ClickHouse WITH map(...) expression, enabling SQL injection.

Detection Guidance

Detecting this vulnerability requires checking for SQL injection patterns in customer usage-attribution values. Inspect logs for suspicious values in usageAttribution.key or usageAttribution.subjectKeys fields. Look for queries containing WITH map(...) expressions with unexpected string concatenation. Review OpenMeter versions between v1.0.0-beta.218 and v1.0.0-beta.231 for affected deployments.

Impact Analysis

This vulnerability allows attackers to execute arbitrary SQL commands on the database, potentially leading to unauthorized data access, modification, or deletion. It could also enable data exfiltration or manipulation of sensitive information stored in OpenMeter.

Compliance Impact

This vulnerability could lead to violations of GDPR, HIPAA, or other regulations by enabling unauthorized access or disclosure of personal or sensitive data. Compliance failures may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade OpenMeter to a version later than v1.0.0-beta.231 to address the stored SQL injection vulnerability in usageAttribution fields.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18801. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart