VULNERABILITY INTELLIGENCE
CVE-2026-18801
EPSS probability0.39%
CISA KEVNot currently listed
Published2026-08-04
Last modified2026-08-31
Description
OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is subsequently used in a meter or event query, OpenMeter inserts the stored value into a ClickHouse WITH map(...) expression using string concatenation. OpenMeter versions from v1.0.0-beta.218 through v1.0.0-beta.231 are affected.
Weakness classification
- 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb: CWE-20