---
id: "CVE-2026-115331"
kind: "vulnerability"
aliases: ["CVE-2026-115331"]
title: "Lotus: SQL injection via billable metric values exposes all tenants' database"
severity: "high"
cvss: 8.8
epss: 0.00284
exploited: false
status: "open"
category: "package"
products: [{"name": "lotus", "fixed": [], "affected": "<= 0.10.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["lotus", "multi-tenant", "package", "self-hosted", "sql-injection"]
not_affected_if: ["auth-required", "managed-hosting"]
published_at: "2026-10-22T11:17:52+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115331", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:42:03+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115331", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Lotus: SQL injection via billable metric values exposes all tenants' database

Lotus through 0.10.2 (uselotus/lotus, self-hosted billing) lets any authenticated organization user inject SQL through billable metric property_name or categorical filter values. The values are rendered unescaped into Jinja counter, gauge and rate query templates and run with cursor.execute on the database shared by all tenants. Self-registration is open by default, so a tenant account is easy to get. The report says DB error text is returned to the client, which allows error-based extraction. No fixed release is known and no exploitation has been reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:lotus affected <= 0.10.2 fixed ?

## How to check

Run 'git describe --tags' in your Lotus checkout, or check the backend image tag. 0.10.2 or earlier is affected. Inspect backend/metering_billing/aggregation/counter_query_templates.py, gauge_query_templates.py and rate_query_templates.py: if property_name or filter values are interpolated into the SQL with Jinja instead of passed as query parameters, you are exposed. Look in the metering_billing metric table for metrics whose property_name contains quotes, semicolons or SQL keywords.

## Fix

No patched release is published as of 2026-10-23; latest is 0.10.2. Until upstream ships one: restrict who can create or edit metrics (turn off open self-registration), run the backend under a non-superuser, least-privilege PostgreSQL role, and put a WAF rule or reverse-proxy filter on POST /app/metrics/. Watch uselotus/lotus releases. Treat PR #800 as an unreviewed community patch.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115331
- 2026-10-23T23:42:03+00:00 analyst — No patched Lotus release exists: 0.10.2 (23 Mar) is the latest release on GitHub and the GHSA/NVD list no fixed version. Researcher's HackMD report (VULN-002) is the only technical source; it is static code review, not a runtime-tested exploit. Sibling CVEs CVE-2026-115330 (custom_sql stacked statements) and CVE-2026-115332 (subscription_filter_key) hit the same release; the HackMD report covers all three. Open PR #800 on the repo is a community fix for the custom query template, not merged. No social search done.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115331

## Documents

- [advisory] VulnCheck: Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters https://www.vulncheck.com/advisories/lotus-through-0.10.2-sql-injection-via-metric-property-names-and-filters
- [mentions] uselotus/lotus releases (latest 0.10.2) https://github.com/uselotus/lotus/releases
- [poc] Application Security Assessment Report (VULN-004), leediay https://hackmd.io/@leediay/BkUc3WL2Mx

## From the sources

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to access the database shared by all tenants.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_