CVE-2026-18801 Overview
CVE-2026-18801 is a stored, second-order SQL injection vulnerability in OpenMeter, an open-source usage metering platform. The flaw resides in the handling of customer usage-attribution values. An attacker with permission to create or update a customer can plant malicious payloads in the usageAttribution.key or usageAttribution.subjectKeys fields. When the customer record is later referenced by a meter or event query, OpenMeter concatenates the stored value directly into a ClickHouse WITH map(...) expression, causing the injected SQL to execute against the analytics database.
Critical Impact
An authenticated attacker can inject arbitrary SQL into ClickHouse queries, exposing metering data, tampering with usage records, and pivoting to further backend compromise.
Affected Products
- OpenMeter v1.0.0-beta.218 through v1.0.0-beta.231
- Deployments using ClickHouse as the OpenMeter analytics backend
- Multi-tenant OpenMeter environments where customer records are user-writable
Discovery Timeline
- 2026-08-04 - CVE-2026-18801 published to NVD
- 2026-08-04 - Last updated in NVD database
Technical Details for CVE-2026-18801
Vulnerability Analysis
OpenMeter accepts customer records containing a usageAttribution object with key and subjectKeys fields. These values are persisted without SQL-context sanitization. When a downstream meter or event query needs to resolve which events belong to a customer, OpenMeter constructs a ClickHouse query that embeds those stored strings into a WITH map(...) clause using raw string concatenation instead of parameter binding.
This is a classic second-order injection pattern [CWE-20]. The initial write appears benign to the application, and the injection only fires when a separate query path consumes the tainted value. Because the sink is a ClickHouse analytical query, an attacker can read from other tables, exfiltrate metering data across tenants, or manipulate aggregation logic used for billing.
Root Cause
The root cause is improper input validation and unsafe query construction. OpenMeter treats stored customer attribution values as trusted at query build time, concatenating them into the SQL string rather than passing them as parameters or applying strict identifier validation.
Attack Vector
The attack requires network access to the OpenMeter API and the ability to create or update a customer, which is a routine tenant-level operation. The attacker stores a crafted payload in usageAttribution.key or usageAttribution.subjectKeys. Exploitation triggers when any subsequent meter or event query references that customer, so the attacker does not need to run the vulnerable query themselves. Refer to the GitHub Security Advisory GHSA-m2fw-9wxq-jgf5 for technical details.
Detection Methods for CVE-2026-18801
Indicators of Compromise
- Customer records where usageAttribution.key or usageAttribution.subjectKeys contain SQL metacharacters such as ', ), --, or the keywords UNION, SELECT, FROM.
- ClickHouse query logs showing malformed or unexpected WITH map(...) expressions originating from OpenMeter.
- Meter or event queries that error with ClickHouse syntax exceptions referencing customer attribution fields.
Detection Strategies
- Review the ClickHouse system.query_log for OpenMeter-issued queries whose text includes syntactically unusual map(...) arguments or nested subqueries.
- Add application-layer logging on customer create and update paths to capture the raw values written to usageAttribution.key and usageAttribution.subjectKeys.
- Correlate customer mutation events with subsequent meter query failures to surface second-order exploitation attempts.
Monitoring Recommendations
- Alert on ClickHouse queries returning rows from tables outside the expected metering schema when initiated by the OpenMeter service account.
- Monitor for spikes in query errors from OpenMeter meter and event endpoints, which often accompany injection probing.
- Track anomalous customer update frequency from single API keys or tenants as an early exploitation signal.
How to Mitigate CVE-2026-18801
Immediate Actions Required
- Upgrade OpenMeter to a release after v1.0.0-beta.231 that includes the fix referenced in the GitHub Security Advisory.
- Audit existing customer records for suspicious values in usageAttribution.key and usageAttribution.subjectKeys and quarantine or sanitize them before running meter queries.
- Restrict customer create and update permissions to trusted service identities until patching is complete.
Patch Information
The OpenMeter maintainers have published a fix through the GitHub Security Advisory GHSA-m2fw-9wxq-jgf5. Operators running any release from v1.0.0-beta.218 through v1.0.0-beta.231 must upgrade to a patched version. Consult the advisory for the exact fixed release and migration notes.
Workarounds
- Enforce strict server-side validation on usageAttribution.key and usageAttribution.subjectKeys, allowing only an alphanumeric and underscore character set.
- Apply a ClickHouse user with least privilege for the OpenMeter service, limited to the metering database and read-only where feasible.
- Temporarily disable customer self-service update endpoints in multi-tenant deployments until the upgrade is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
