Vulnerability · Published Aug 4, 2026 · Assigned by Kong

CVE-2026-18801Stored Clickhouse SQL Injection Through Customer Usage Attribution

Critical 9.3

In plain English

A critical-severity improper input validation in openmeter from openmeter. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.4%top 67.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is subsequently used in a meter or event query, OpenMeter inserts the stored value into a ClickHouse WITH map(...) expression using string concatenation. OpenMeter versions from v1.0.0-beta.218 through v1.0.0-beta.231 are affected.

Affected products (as reported)

Vendor	Product	Versions
openmeter	openmeter	v1.0.0-beta.218 – through v1.0.0-beta.231

Weakness: CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H

References

https://github.com/openmeterio/openmeter/security/advisories/GHSA-m2fw-9wxq-jgf5