{"id":"CVE-2026-115331","kind":"vulnerability","aliases":["CVE-2026-115331"],"related":[],"title":"Lotus: SQL injection via billable metric values exposes all tenants' database","description":"Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to access the database shared by all tenants.","summary":"Lotus through 0.10.2 (uselotus/lotus, self-hosted billing) lets any authenticated organization user inject SQL through billable metric property_name or categorical filter values. The values are rendered unescaped into Jinja counter, gauge and rate query templates and run with cursor.execute on the database shared by all tenants. Self-registration is open by default, so a tenant account is easy to get. The report says DB error text is returned to the client, which allows error-based extraction. No fixed release is known and no exploitation has been reported.","severity":"high","cvss":8.8,"epss":0.00284,"exploited":false,"exploited_at":null,"products":[{"name":"lotus","fixed":[],"affected":"<= 0.10.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["lotus","multi-tenant","package","self-hosted","sql-injection"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"Run 'git describe --tags' in your Lotus checkout, or check the backend image tag. 0.10.2 or earlier is affected. Inspect backend/metering_billing/aggregation/counter_query_templates.py, gauge_query_templates.py and rate_query_templates.py: if property_name or filter values are interpolated into the SQL with Jinja instead of passed as query parameters, you are exposed. Look in the metering_billing metric table for metrics whose property_name contains quotes, semicolons or SQL keywords.","fix":"No patched release is published as of 2026-10-23; latest is 0.10.2. Until upstream ships one: restrict who can create or edit metrics (turn off open self-registration), run the backend under a non-superuser, least-privilege PostgreSQL role, and put a WAF rule or reverse-proxy filter on POST /app/metrics/. Watch uselotus/lotus releases. Treat PR #800 as an unreviewed community patch.","status":"open","published_at":"2026-10-22T11:17:52+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-23T22:32:25+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:32:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Lotus: SQL injection via billable metric values exposes all tenants' database","impact":"high","summary":"Lotus through 0.10.2 lets an authenticated organization user inject SQL through billable metric property_name or categorical filter values. The injected SQL reaches the database shared by all tenants, so an attacker can read or alter other tenants' data.","category":"package","who_cares":["lotus","multi-tenant","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads or changes other tenants' data in the shared database","analyst_note":"Find the patched Lotus release after 0.10.2 and the upstream advisory or commit at the NVD link; confirm the affected billable metric code path and any workaround.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000467,"input_tokens":2942,"output_tokens":346,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the patched Lotus release after 0.10.2 and the upstream advisory or commit at the NVD link; confirm the affected billable metric code path and any workaround.","search":"'-115331':14A,17A '-2026':13A,16A '0.10.2':32B,123C 'access':167C 'account':88B 'allow':105B,130C 'attack':148C 'authent':40B,131C 'base':108B 'bill':37B 'billabl':5A,46B,140C 'categor':51B,145C 'client':103B 'contain':124C 'counter':61B,160C 'craft':139C 'cursor.execute':70B 'cve':12A,15A 'databas':11A,73B,169C 'db':96B 'default':84B 'easi':90B 'emb':150C 'error':97B,107B 'error-bas':106B 'exploit':117B 'expos':8A 'extract':109B 'filter':52B,146C 'fix':111B 'gaug':62B,161C 'generat':159C 'get':92B 'host':26B,36B 'inject':3A,29B,43B,127C,135C 'jinja':60B,158C 'jinja-gener':157C 'known':114B 'let':38B 'lotus':1A,18A,19B,30B,121C 'metric':6A,47B,141C,164C 'multi':21B 'multi-ten':20B 'name':49B,143C 'open':82B 'organ':41B,132C 'packag':23B 'properti':48B,142C 'queri':65B,165C 'rate':64B,163C 'registr':80B 'releas':112B 'render':57B,154C 'report':94B,120B 'return':100B 'run':68B 'say':95B 'self':25B,35B,79B 'self-host':24B,34B 'self-registr':78B 'share':74B,170C 'sql':2A,28B,44B,126C,136C,151C 'sql-inject':27B 'suppli':138C 'templat':66B 'tenant':10A,22B,77B,87B,173C 'text':98B 'unescap':58B,155C 'uselotus/lotus':33B 'user':42B,133C 'valu':7A,53B,55B,147C,153C 'via':4A 'vulner':128C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-115331","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115331","severity":null,"published_at":"2026-10-22T11:17:52+00:00","modified_at":"2026-10-22T16:53:20+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115331:497","url":null,"severity":null,"published_at":"2026-10-23T23:42:03+00:00","modified_at":"2026-10-23T23:42:03+00:00","first_seen_at":"2026-10-23T23:42:03+00:00","fetched_at":"2026-10-23T23:42:03+00:00","note":"No patched Lotus release exists: 0.10.2 (23 Mar) is the latest release on GitHub and the GHSA/NVD list no fixed version. Researcher's HackMD report (VULN-002) is the only technical source; it is static code review, not a runtime-tested exploit. Sibling CVEs CVE-2026-115330 (custom_sql stacked statements) and CVE-2026-115332 (subscription_filter_key) hit the same release; the HackMD report covers all three. Open PR #800 on the repo is a community fix for the custom query template, not merged. No social search done."},{"source":"epss","external_id":"CVE-2026-115331","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115331","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[{"id":2112,"url":"https://hackmd.io/@leediay/BkUc3WL2Mx","title":"Application Security Assessment Report (VULN-004), leediay","kind":"advisory","source":"analyst","text":"Third-party static audit: VULN-004 Go event-ingestion authenticates by 8-char prefix only; POST /api/track/; status Partially Verified (code-derived, not executed).","published_at":null,"relation":"poc","confidence":null,"note":null},{"id":2123,"url":"https://www.vulncheck.com/advisories/lotus-through-0.10.2-sql-injection-via-metric-property-names-and-filters","title":"VulnCheck: Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2115,"url":"https://github.com/uselotus/lotus/releases","title":"uselotus/lotus releases (latest 0.10.2)","kind":"release","source":"analyst","text":"Latest release 0.10.2 (23 Mar). No release notes mention an authn fix.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}