OpenMeter stores customer usage attribution fields without proper sanitization, allowing a stored, second‑order SQL injection that is later executed when the customer data is used in a ClickHouse query. An attacker who can create or update a customer can embed malicious SQL in usageAttribution.key or usageAttribution.subjectKeys, which is concatenated into a ClickHouse WITH map expression. This flaw can lead to arbitrary SQL execution on the ClickHouse database, compromising confidentiality, integrity, and availability of the data.

The affected product is OpenMeter from the openmeter:openmeter CNA. Versions v1.0.0-beta.218 through v1.0.0-beta.231 are vulnerable. No other versions or related modules are listed as affected.

The CVSS score of 9.3 marks the issue as critical, and the absence of an EPSS score does not diminish the high likelihood of exploitation in environments where customers can be created or updated. The flaw requires an authenticated user with privileges to modify customer records; once a malicious value is stored, the next query that references that customer triggers the injection. The vulnerability is not listed in CISA KEV, but its severity suggests proactive mitigation. Attackers can deploy the exploit without network exposure, making it a high‑risk internal threat.