Security readout for executives and security teams
Plain-English summary
OpenMeter can store attacker-controlled customer attribution data and later treat it as part of a ClickHouse database query. This could expose or disrupt data and alter query results. The supplied CVSS score is 9.3, making affected internet-reachable or broadly accessible deployments an urgent business risk.
Executive priority
Treat affected deployments as an immediate remediation priority, especially where customer-management functions are externally reachable or available to untrusted users. Confirm exposure now, restrict risky interfaces if necessary, and follow the vendor advisory for supported remediation. Evidence provided does not establish active exploitation.
Technical view
CVE-2026-18801 is a stored SQL injection in OpenMeter. Values placed in usageAttribution.key or usageAttribution.subjectKeys are later concatenated into a ClickHouse WITH map(...) expression during meter or event queries. Versions v1.0.0-beta.218 through v1.0.0-beta.231 are reported affected.
Likely exposure
Exposure requires an affected OpenMeter version and a path allowing an attacker to create or update customer attribution values. The stored value must later reach a meter or event query. The supplied CVSS vector describes network access, low complexity, no privileges, and no user interaction.
Exploitation context
The source bundle does not report known active exploitation, and this CVE is not identified as CISA KEV-listed. Exploitation is second-order: malicious input is stored first, then interpreted when a later query uses that customer. No public exploit availability is established by the supplied evidence.
Researcher notes
The reported weakness is a stored injection crossing from customer data into ClickHouse query generation. CWE-20 is assigned, while the described root behavior is unsafe string concatenation. Researchers should verify the affected data flow and remediation without testing destructive payloads. The supplied bundle does not name a fixed version.
Mitigation direction
- Identify and prioritize OpenMeter versions v1.0.0-beta.218 through v1.0.0-beta.231.
- Check the OpenMeter advisory for the vendor-supported fixed release or mitigation.
- Restrict untrusted access to customer creation and update interfaces until remediation.
- Monitor customer attribution changes and associated meter or event query failures.
Validation and detection
- Inventory deployed OpenMeter versions and compare them with the affected range.
- Review authorization paths for creating or updating customer usage-attribution fields.
- Trace whether attribution values reach ClickHouse query construction through string concatenation.
- Review logs for unusual attribution changes, query errors, or unexpected ClickHouse behavior.
- Confirm remediation using vendor guidance and regression tests for safe query parameter handling.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-20: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-18801 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H——KongVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/openmeterio/openmeter/security/advisories/GHSA-m2fw-9wxq-jgf5CVE reference, Kong
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Input Validation
Improper Input Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.