CVE-2026-18801

Stored Clickhouse SQL Injection Through Customer Usage Attribution

Assigner: Kong
Reserved: 04.08.2026 Published: 04.08.2026 Updated: 04.08.2026

OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values.

An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is subsequently used in a meter or event query, OpenMeter inserts the stored value into a ClickHouse WITH map(...) expression using string concatenation.

OpenMeter versions from v1.0.0-beta.218 through v1.0.0-beta.231 are affected.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H
CVSS Score: 9.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	High
Attack Complexity	Low	Integrity	Low	Integrity	Low
Attack Requirements	None	Availability	High	Availability	High
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	openmeter
Product	openmeter
Versions	Default: unaffected affected from v1.0.0-beta.218 to v1.0.0-beta.231 (incl.)

Vendor

openmeter

Product

openmeter

Versions

Default: unaffected

affected from v1.0.0-beta.218 to v1.0.0-beta.231 (incl.)

References

Problem Types

CWE-20 Improper input validation CWE

Impacts