PatchSiren cyber security CVE debrief

CVE-2026-18801 openmeter CVE debrief

OpenMeter contains a stored SQL injection vulnerability via customer usage-attribution values. Attackers can inject malicious values in usageAttribution.key or usageAttribution.subjectKeys when creating or updating a customer. These values are inserted into ClickHouse WITH map(...) expressions using string concatenation during meter or event queries. Affected versions: v1.0.0-beta.218 through v1.0.0-beta.231. Organizations should prioritize patching to prevent SQL injection attacks. The vulnerability allows attackers to store malicious values that are later used in database queries without proper sanitization. This issue impacts OpenMeter deployments, particularly those exposed or internet-facing.

Vendor: openmeter
Product: Unknown
CVSS: CRITICAL 9.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-08-04
Original CVE updated: 2026-08-31
Advisory published: 2026-08-04
Advisory updated: 2026-08-31

Who should care

Organizations using OpenMeter, particularly those with exposed or internet-facing instances, should be aware of this critical vulnerability and take immediate action to patch or mitigate the risk.

Technical summary

OpenMeter contains a stored SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is subsequently used in a meter or event query, OpenMeter inserts the stored value into a ClickHouse WITH map(...) expression using string concatenation. Affected versions are from v1.0.0-beta.218 through v1.0.0-beta.231.

Defensive priority

Organizations using OpenMeter should prioritize patching to prevent potential SQL injection attacks.

Recommended defensive actions

Review and apply patches for OpenMeter versions v1.0.0-beta.218 through v1.0.0-beta.231
Restrict access to customer creation and update operations
Monitor usage-attribution values for suspicious activity
Implement additional security controls to detect and prevent SQL injection attacks
Conduct a thorough review of current OpenMeter deployments to identify exposed instances
Develop and deploy compensating controls for exposed systems while remediation is scheduled
Track exceptions and retest remediated assets to ensure vulnerability resolution

Evidence notes

The CVE description indicates that OpenMeter contains a stored SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is subsequently used in a meter or event query, OpenMeter inserts the stored value into a ClickHouse WITH map(...) expression using string concatenation. Affected versions are from v1.0.0-beta.218 through v1.0.0-beta.231.

Sources and references

Verified primary and authoritative sources

CVE-2026-18801 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-18801

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-18801 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-18801

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://github.com/openmeterio/openmeter/security/advisories/GHSA-m2fw-9wxq-jgf5

02762ae7-200e-4b20-9b2b-a77d5b8fc4cb

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.