{"id":"CVE-2026-18801","published":"2026-08-04T16:16:22.647","lastModified":"2026-08-04T19:16:44.933","description":"OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values.\n\n\n\nAn attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is subsequently used in a meter or event query, OpenMeter inserts the stored value into a ClickHouse WITH map(...) expression using string concatenation.\n\nOpenMeter versions from v1.0.0-beta.218 through v1.0.0-beta.231 are affected.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-20"],"vendors":[],"products":[],"references":[{"url":"https://github.com/openmeterio/openmeter/security/advisories/GHSA-m2fw-9wxq-jgf5","tags":[]}],"exploitRefs":[{"url":"https://github.com/openmeterio/openmeter/security/advisories/GHSA-m2fw-9wxq-jgf5","tags":[]}],"hasPoc":true,"ai":null}