External risk intelligence

OpenMeter SQL Injection in Customer Usage Attribution.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-18801

OpenMeter is a metering and usage-based billing tool typically deployed as a backend API service that ingests event data. Because these services are commonly exposed to receive traffic from multiple systems or public-facing application components, the attack surface is likely to be network-reachable in common cloud-native deployment patterns.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

OpenMeter, a platform for customer usage data and billing, has a vulnerability where specially crafted customer data can lead to unintended database access when queried. While the direct impact is not specified, this could potentially expose sensitive usage information if exploited. The main concern is confirming relevance and exposure.

Malicious data can allow unauthorized access.
Sensitive usage data could be compromised.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by first gaining the ability to create or update customer records within OpenMeter. By inserting specially crafted values into the `usageAttribution.key` or `usageAttribution.subjectKeys` fields, the attacker can then trigger the vulnerability when these customer records are queried. This process could allow the attacker to execute unintended SQL commands against the database.

Attacker can create or update customer data.
Malicious values are inserted into queries.
Risk of unauthorized SQL command execution.

Live Threat

Current exploitation, exposure, and threat context

A stored SQL injection vulnerability in OpenMeter could allow an attacker to manipulate customer usage attribution data. When this data is later queried, it could be used to execute arbitrary SQL commands against the ClickHouse database.

Customer usage data.
Malicious data stored in attribution fields.
Unauthorized database access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The application owner and platform team are most likely responsible for addressing this stored SQL injection vulnerability in OpenMeter. The initial focus should be on identifying all instances of OpenMeter within the environment, confirming their network reachability and business criticality, and then locating the specific asset owner for remediation planning based on the identified risk.

Identify asset owners and criticality.
Verify network exposure and reachability.
Plan remediation or mitigation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenMeter?

OpenMeter is an open-source platform designed to handle usage-based billing and customer usage data. It functions primarily as a backend API service that ingests large volumes of event data to track how customers use a product. By providing a centralized way to meter and aggregate this information, it allows organizations to automate billing processes and gain insights into service consumption.

What does CVE-2026-18801 mean?

This vulnerability is a stored SQL injection, specifically categorized as CWE-20 (Improper Input Validation). In plain terms, the software accepts and saves malicious input without checking it correctly. Because the application later uses this stored data to build database queries through string concatenation, an attacker can manipulate those queries to run unauthorized commands against the underlying ClickHouse database.

How does the vulnerability get triggered?

The flaw is triggered when an attacker creates or updates a customer record using malicious content in the usageAttribution.key or usageAttribution.subjectKeys fields. Crucially, the vulnerability does not occur upon initial storage; it is only activated later when the system processes a meter or event query that includes those specific, tainted customer records.

Is my instance at risk?

According to Halo Surface Signal, OpenMeter is typically deployed as a backend service designed to ingest event data from various systems. Because these services are often positioned to receive traffic from multiple internal or external application components, the attack surface is likely network-reachable. You should evaluate if your deployment is accessible from broader network segments.

What should I do to respond to this issue?

Start by identifying all deployed instances of OpenMeter within your environment to determine which are active and business-critical. Once you have an inventory, coordinate with the respective asset owners to verify their network exposure. Prioritize these systems for remediation planning by assessing the risk to the sensitive usage data stored in your ClickHouse database.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.