How do I check whether I am affected by CVE-2026-115332?

Run pip/docker to see your Lotus version (0.10.2 or earlier = affected, and 0.10.2 is the latest release). Inspect the organization's subscription_filter_keys in the DB (metering_billing_organization) for anything that is not a plain identifier matching ^[A-Za-z_][A-Za-z0-9_]{0,63}$.

What is the fix for CVE-2026-115332?

No fixed version published. Mitigate: restrict who can sign up or hold org accounts (disable open registration), run Lotus with a least-privilege, non-superuser DB role, and patch locally by enforcing the allowlist regex ^[A-Za-z_][A-Za-z0-9_]{0,63}$ on subscription_filter_keys and subscription_filters[].property_name, and quoting identifiers in the query templates. Consider migrating off Lotus.

Who is not affected by CVE-2026-115332?

Not affected if: auth-required, managed-hosting.

Live › vulnerability › CVE-2026-115332

Go to dashboard

high8.8Othergithub

Lotus: authenticated tenants can inject SQL via subscription filter keys

Lotus (uselotus/lotus) through 0.10.2: any authenticated org user can register a subscription_filter_key that passes an exact-match keyword blacklist. It is rendered as an unquoted group-by identifier in usage aggregation SQL on a shared multi-tenant database. No patched release exists, and the project appears unmaintained.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

8.8

high

scored by [email protected]

known so far6 of 6

First public: Oct 22, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.3% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker reads or alters other tenants' data in the shared database.
CVSS said: 8.8. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-115332

Go to dashboard

high8.8Othergithub

Lotus: authenticated tenants can inject SQL via subscription filter keys

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

8.8

high

scored by [email protected]

known so far6 of 6

First public: Oct 22, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.3% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker reads or alters other tenants' data in the shared database.
CVSS said: 8.8. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Lotus: authenticated tenants can inject SQL via subscription filter keys

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

Lotus: authenticated tenants can inject SQL via subscription filter keys

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources