Executive brief
OpenMeter is a metering and usage-attribution platform that tracks customer resource consumption. An authenticated attacker can inject malicious SQL code via customer configuration fields, allowing them to query or modify data across all customers in the shared database, including reading other tenants' billing and usage records without authorization.
Technical details
This is a stored SQL injection vulnerability in the customer usage-attribution handling. The root cause is in queryhelper.go, where customer usageAttribution.key and usageAttribution.subjectKeys are concatenated into a ClickHouse WITH map(...) SQL expression using string concatenation with sqlbuilder.Escape(), which only escapes dollar signs and does not escape single quotes. An authenticated tenant who can create or update a customer can store a malicious SQL payload in these fields; when the customer is later used as a filter in meter or event queries, the payload is executed against the shared ClickHouse database with no row-level security, allowing access to all tenants' event data. Affected versions: v1.0.0-beta.218 through v1.0.0-beta.231. The fix requires replacing fmt.Sprintf string concatenation with parameterized queries (sb.Var).
Affected products
- OpenMeter OpenMeter v1.0.0-beta.218 through v1.0.0-beta.231
Timeline
- 2026-08-04: disclosed: Published on NVD and GitHub advisory GHSA-m2fw-9wxq-jgf5
- 2026-08-05: other: GitHub advisory published