Which versions of OpenMeter are affected by CVE-2026-18801?

OpenMeter versions 1.0.0-beta.218 through 1.0.0-beta.231 contain a stored SQL injection vulnerability in the billing backend that allows authenticated actors with customer management privileges to…

How to fix or mitigate CVE-2026-18801?

Within 24 hours: Restrict customer creation and update permissions to senior administrators only; enable audit logging on all customer management operations; begin monitoring ClickHouse query logs for SQL injection patterns. Within 7 days: Scan all usageAttribution.key and usageAttribution.subjectKeys fields for suspicious syntax or encoded payloads; audit billing records for unauthorized modifications since affected versions deployed; isolate ClickHouse backend network access to trusted internal systems. Within 30 days: Apply vendor patch immediately upon release; conduct comprehensive data reconciliation of all usage and billing records; validate data integrity against independent billing systems and customer contracts.

OpenMeter CVE-2026-18801

Q: What is the CVSS score of CVE-2026-18801?

CVE-2026-18801 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-52725 CRITICAL

Improper Input Validation (CWE-20)

2026-08-04 Kong

GHSA-r49g-35qj-7264

SQLi Openmeter

9.3

CVSS 4.0 · Vendor: Kong

Severity by source

Vendor (Kong) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network-reachable and low-complexity, but storing the payload requires authenticated customer-write access (PR:L); injection into the separate ClickHouse backend justifies S:C with high confidentiality/availability and limited integrity impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H

Primary rating from Vendor (Kong).

CVSS VectorVendor: Kong

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 16:11 vuln.today

CVE Published

Aug 04, 2026 - 14:53 cve.org

CRITICAL 9.3

DescriptionCVE.org

OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values.

An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is subsequently used in a meter or event query, OpenMeter inserts the stored value into a ClickHouse WITH map(...) expression using string concatenation.

OpenMeter versions from v1.0.0-beta.218 through v1.0.0-beta.231 are affected.

AnalysisAI

Stored (second-order) SQL injection in OpenMeter (v1.0.0-beta.218 through v1.0.0-beta.231) lets an actor who can create or update a customer plant a malicious payload in the usageAttribution.key or usageAttribution.subjectKeys fields, which is later concatenated unsanitized into a ClickHouse WITH map(...) expression when the customer is referenced in a meter or event query. The delayed execution means the injection fires during downstream analytics/metering operations rather than at input time, giving an attacker read/manipulation access to the ClickHouse backend that stores usage and billing telemetry. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the vendor-assigned CVSS 4.0 base score is 9.3 (Critical).

Technical ContextAI

OpenMeter is an open-source usage metering and billing platform that ingests event streams and aggregates them in ClickHouse, a columnar OLAP database. The vulnerable path is customer usage attribution: the usageAttribution.key and usageAttribution.subjectKeys values supplied when creating/updating a customer are persisted and, at query time, embedded into a dynamically built ClickHouse WITH map(...) common-table expression via raw string concatenation rather than parameterized/bound queries. This is a classic second-order injection - the untrusted value is stored safely-looking in one operation and only becomes dangerous when a separate meter or event query interpolates it into SQL. NVD assigns CWE-20 (Improper Input Validation) as the root-cause class, though the concrete manifestation is SQL injection (CWE-89); the CPE cpe:2.3:a:openmeter:openmeter:*:*:*:*:*:*:*:* confirms the application itself is the affected component.

RemediationAI

Upgrade to a fixed OpenMeter release above v1.0.0-beta.231 as published in the vendor advisory GHSA-m2fw-9wxq-jgf5 (https://github.com/openmeterio/openmeter/security/advisories/GHSA-m2fw-9wxq-jgf5); no exact patched version number is provided in the available data, so consult that advisory for the precise fixed build rather than assuming one. If immediate patching is not possible, restrict who can create or update customers by tightening authentication and authorization on the customer-management API so untrusted or self-service actors cannot set usageAttribution values, and validate/allowlist those fields to safe character sets (e.g., alphanumeric subject keys) at the ingress layer - the trade-off is that overly strict validation may reject legitimate subject keys that contain special characters. As a defense-in-depth measure, run ClickHouse with a least-privilege account scoped only to the metering database and monitor for anomalous WITH map(...) query patterns; note this limits blast radius but does not close the injection itself.