{"id":"CVE-2026-18801","summary":"Stored Clickhouse SQL Injection Through Customer Usage Attribution","details":"OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values.\n\n\n\nAn attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is subsequently used in a meter or event query, OpenMeter inserts the stored value into a ClickHouse WITH map(...) expression using string concatenation.\n\nOpenMeter versions from v1.0.0-beta.218 through v1.0.0-beta.231 are affected.","aliases":["GHSA-m2fw-9wxq-jgf5"],"modified":"2026-08-06T03:48:13.771574261Z","published":"2026-08-04T14:53:01.659Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18801.json","cna_assigner":"Kong","cwe_ids":["CWE-20"]},"references":[{"type":"WEB","url":"https://github.com/openmeterio/openmeter/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18801.json"},{"type":"ADVISORY","url":"https://github.com/openmeterio/openmeter/security/advisories/GHSA-m2fw-9wxq-jgf5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18801"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openmeterio/openmeter","events":[{"introduced":"88332a1d268929f12c09e3dc3608514a61785373"},{"fixed":"9d0d3a4d902a156f4591db0f8e09742dacccbda4"}],"database_specific":{"extracted_events":[{"introduced":"v1.0.0-beta.218"},{"last_affected":"v1.0.0-beta.231"},{"fixed":"v1.0.0-beta.231"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["v1.0.0-beta.230","api/v3/client/v1.0.0-beta.230","v1.0.0-beta.229","v1.0.0-beta.228","v1.0.0-beta.227","v1.0.0-beta.226","v1.0.0-beta.225","v1.0.0-beta.224","v1.0.0-beta.223","v1.0.0-beta.222","v1.0.0-beta.221","v1.0.0-beta.220","v1.0.0-beta.219","v1.0.0-beta.218"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18801.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H"}]}