{"id":"CVE-2026-115330","kind":"vulnerability","aliases":["CVE-2026-115330"],"related":[],"title":"Lotus: stacked SQL in custom metrics reads or edits all tenants' data","description":"Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants.","summary":"Lotus (uselotus, open-source usage billing) through 0.10.2 lets any logged-in user, including self-registered ones, create a 'custom' metric whose custom_sql runs on the shared Postgres database. validate_custom_sql checks only the first statement (sqlparse parsed_sql[0]), so after a ';' the attacker can run any SQL. That reads or changes every tenant's data, and DB errors are echoed back, which enables extraction. The same researcher reports related injection through property_name and subscription filters, plus an org-switch authorization flaw. No fixed version has been published.","severity":"high","cvss":8.8,"epss":0.00298,"exploited":false,"exploited_at":null,"products":[{"name":"lotus","fixed":[],"affected":"<= 0.10.2","ecosystem":"github"}],"ecosystems":["github"],"tags":["billing","lotus","multi-tenant","other","self-hosted","sql-injection"],"not_affected_if":["auth-required","managed-hosting","no-untrusted-users"],"how_to_check":"Self-hosted Lotus <= 0.10.2 (check the image tag or the git tag you deployed) is affected. Look at backend/metering_billing/aggregation/billable_metrics.py: if validate_custom_sql only inspects parsed_sql[0], you are exposed. Audit existing metrics with: SELECT * FROM metering_billing_metric WHERE metric_type='custom' and look for ';' in custom_sql. Check the DB logs for unexpected DDL/DML from the app role.","fix":"No patched release as of 2026-10-23 (0.10.2 is the latest). Mitigations: block POST /app/metrics/ with metric_type=custom at the proxy; disable open self-registration; run the app on a non-superuser DB role with minimal grants; reject multi-statement custom_sql with a local patch. Watch github.com/uselotus/lotus for a fix.","status":"open","published_at":"2026-10-22T11:17:52+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-23T22:32:25+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:32:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Lotus: stacked SQL in custom metrics reads or edits all tenants' data","impact":"high","summary":"Lotus through version 0.10.2 lets an logged-in organization user run arbitrary SQL by appending a second statement to a custom metric query sent to POST /app/metrics/. The validation only checks the first statement, so the attacker can read or change data belonging to every tenant.","category":"other","who_cares":["lotus","self-hosted","multi-tenant"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads or modifies every tenant's database rows","analyst_note":"Sources do not name a patched version or a fixed release; check the Lotus project repository or advisory for the fix version and whether metric queries can be disabled.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00047,"input_tokens":2942,"output_tokens":351,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources do not name a patched version or a fixed release; check the Lotus project repository or advisory for the fix version and whether metric queries can be disabled.","search":"'-115330':15A,18A '-2026':14A,17A '/app/metrics':162C '0':76B '0.10.2':40B,130C 'across':174C 'allow':137C 'append':146C 'arbitrari':143C 'attack':81B,153C 'authent':138C 'author':120B 'back':99B 'bill':20B,38B 'bypass':163C 'chang':89B 'check':68B 'contain':131C 'creat':52B 'custom':5A,54B,57B,66B,150C 'cve':13A,16A 'data':12A,93B,173C 'databas':64B 'db':95B 'echo':98B 'edit':9A 'enabl':101B 'error':96B 'everi':90B 'execut':142C 'extract':102B 'filter':114B 'first':71B,165C 'first-statement-on':164C 'fix':123B 'flaw':121B 'host':28B 'includ':47B 'inject':31B,108B,134C 'let':41B 'log':44B 'logged-in':43B 'lotus':1A,19A,21B,32B,128C 'metric':6A,55B,151C 'modifi':172C 'multi':23B 'multi-ten':22B 'name':111B 'one':51B 'open':35B 'open-sourc':34B 'org':118B 'org-switch':117B 'organ':139C 'pars':74B 'plus':115B 'post':161C 'postgr':63B 'properti':110B 'publish':127B 'queri':152C 'read':7A,87B,170C 'regist':50B 'relat':107B 'report':106B 'research':105B 'run':59B,83B 'self':27B,49B 'self-host':26B 'self-regist':48B 'semicolon':157C 'semicolon-separ':156C 'separ':158C 'share':62B 'sourc':36B 'sql':3A,30B,58B,67B,75B,85B,133C,144C,159C 'sql-inject':29B 'sqlpars':73B 'stack':2A,147C 'statement':72B,148C,166C 'submit':155C 'subscript':113B 'switch':119B 'tenant':11A,24B,91B,176C 'usag':37B 'uselotus':33B 'user':46B,140C 'valid':65B,168C 'version':124B 'vulner':135C 'whose':56B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-115330","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115330","severity":null,"published_at":"2026-10-22T11:17:52+00:00","modified_at":"2026-10-22T16:53:20+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115330:498","url":null,"severity":null,"published_at":"2026-10-23T23:41:55+00:00","modified_at":"2026-10-23T23:41:55+00:00","first_seen_at":"2026-10-23T23:41:55+00:00","fetched_at":"2026-10-23T23:41:55+00:00","note":"No vendor advisory or fixed release found; latest GitHub release is 0.10.2 (affected). Researcher writeup (hackmd) gives code-level PoC, not observed exploited; no X chatter (count 0). Mitigation is from researcher's remediation advice."},{"source":"epss","external_id":"CVE-2026-115330","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115330","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":2112,"url":"https://hackmd.io/@leediay/BkUc3WL2Mx","title":"Application Security Assessment Report (VULN-004), leediay","kind":"advisory","source":"analyst","text":"Third-party static audit: VULN-004 Go event-ingestion authenticates by 8-char prefix only; POST /api/track/; status Partially Verified (code-derived, not executed).","published_at":null,"relation":"poc","confidence":null,"note":null},{"id":2120,"url":"https://www.vulncheck.com/advisories/lotus-through-0.10.2-sql-injection-via-custom-sql-billable-metrics","title":"VulnCheck: Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2115,"url":"https://github.com/uselotus/lotus/releases","title":"uselotus/lotus releases (latest 0.10.2)","kind":"release","source":"analyst","text":"Latest release 0.10.2 (23 Mar). No release notes mention an authn fix.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}