---
id: "CVE-2026-115330"
kind: "vulnerability"
aliases: ["CVE-2026-115330"]
title: "Lotus: stacked SQL in custom metrics reads or edits all tenants' data"
severity: "high"
cvss: 8.8
epss: 0.00298
exploited: false
status: "open"
category: "other"
products: [{"name": "lotus", "fixed": [], "affected": "<= 0.10.2", "ecosystem": "github"}]
ecosystems: ["github"]
tags: ["billing", "lotus", "multi-tenant", "other", "self-hosted", "sql-injection"]
not_affected_if: ["auth-required", "managed-hosting", "no-untrusted-users"]
published_at: "2026-10-22T11:17:52+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115330", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:41:55+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115330", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Lotus: stacked SQL in custom metrics reads or edits all tenants' data

Lotus (uselotus, open-source usage billing) through 0.10.2 lets any logged-in user, including self-registered ones, create a 'custom' metric whose custom_sql runs on the shared Postgres database. validate_custom_sql checks only the first statement (sqlparse parsed_sql[0]), so after a ';' the attacker can run any SQL. That reads or changes every tenant's data, and DB errors are echoed back, which enables extraction. The same researcher reports related injection through property_name and subscription filters, plus an org-switch authorization flaw. No fixed version has been published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:lotus affected <= 0.10.2 fixed ?

## How to check

Self-hosted Lotus <= 0.10.2 (check the image tag or the git tag you deployed) is affected. Look at backend/metering_billing/aggregation/billable_metrics.py: if validate_custom_sql only inspects parsed_sql[0], you are exposed. Audit existing metrics with: SELECT * FROM metering_billing_metric WHERE metric_type='custom' and look for ';' in custom_sql. Check the DB logs for unexpected DDL/DML from the app role.

## Fix

No patched release as of 2026-10-23 (0.10.2 is the latest). Mitigations: block POST /app/metrics/ with metric_type=custom at the proxy; disable open self-registration; run the app on a non-superuser DB role with minimal grants; reject multi-statement custom_sql with a local patch. Watch github.com/uselotus/lotus for a fix.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115330
- 2026-10-23T23:41:55+00:00 analyst — No vendor advisory or fixed release found; latest GitHub release is 0.10.2 (affected). Researcher writeup (hackmd) gives code-level PoC, not observed exploited; no X chatter (count 0). Mitigation is from researcher's remediation advice.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115330

## Documents

- [advisory] VulnCheck: Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics https://www.vulncheck.com/advisories/lotus-through-0.10.2-sql-injection-via-custom-sql-billable-metrics
- [mentions] uselotus/lotus releases (latest 0.10.2) https://github.com/uselotus/lotus/releases
- [poc] Application Security Assessment Report (VULN-004), leediay https://hackmd.io/@leediay/BkUc3WL2Mx

## From the sources

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_