openmeter CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL openmeter CVE published 2026-08-04

CVE-2026-18801

OpenMeter contains a stored SQL injection vulnerability via customer usage-attribution values. Attackers can inject malicious values in usageAttribution.key or usageAttribution.subjectKeys when creating or updating a customer. These values are inserted into ClickHouse WITH map(...) expressions using string concatenation during meter or event queries. Affected versions: v1.0.0-beta.218 through v1.0.0-beta. [truncated]