Live › vulnerability › CVE-2026-115331
Go to dashboardLotus through 0.10.2 (uselotus/lotus, self-hosted billing) lets any authenticated organization user inject SQL through billable metric property_name or categorical filter values. The values are rendered unescaped into Jinja counter, gauge and rate query templates and run with cursor.execute on the database shared by all tenants. Self-registration is open by default, so a tenant account is easy to get. The report says DB error text is returned to the client, which allows error-based extraction. No fixed release is known and no exploitation has been reported.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| lotus | vendor | <= 0.10.2 | – |
git describe --tags in your Lotus checkout, or check the backend image tag. 0.10.2 or earlier is affected0.10.2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to access the database shared by all tenants.
This page as .md · .json · in your agent: get_signal("CVE-2026-115331")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.