CVE-2026-18801
2026-08-04
16h16 +00:00
16h16 +00:00
指定 CVE 通知
掌握特定 CVE 的任何變更。
CVE 描述
OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values.
An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is subsequently used in a meter or event query, OpenMeter inserts the stored value into a ClickHouse WITH map(...) expression using string concatenation.
OpenMeter versions from v1.0.0-beta.218 through v1.0.0-beta.231 are affected.
CVE 資訊
相關弱點
| 弱點名稱 | 來源 | |
|---|---|---|
| Improper Input Validation The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
