---
id: "CVE-2026-115332"
kind: "vulnerability"
aliases: ["CVE-2026-115332"]
title: "Lotus: authenticated tenants can inject SQL via subscription filter keys"
severity: "high"
cvss: 8.8
epss: 0.00304
exploited: false
status: "open"
category: "other"
products: [{"name": "lotus", "fixed": [], "affected": "<= 0.10.2", "ecosystem": "github"}]
ecosystems: ["github"]
tags: ["django", "lotus", "multi-tenant", "other", "package", "postgresql", "self-hosted", "sql-injection"]
not_affected_if: ["auth-required", "managed-hosting"]
published_at: "2026-10-22T11:17:52+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115332", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:41:10+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115332", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Lotus: authenticated tenants can inject SQL via subscription filter keys

Lotus (uselotus/lotus) through 0.10.2: any authenticated org user can register a subscription_filter_key that passes an exact-match keyword blacklist. It is rendered as an unquoted group-by identifier in usage aggregation SQL on a shared multi-tenant database. No patched release exists, and the project appears unmaintained.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:lotus affected <= 0.10.2 fixed ?

## How to check

Run pip/docker to see your Lotus version (0.10.2 or earlier = affected, and 0.10.2 is the latest release). Inspect the organization's subscription_filter_keys in the DB (metering_billing_organization) for anything that is not a plain identifier matching ^[A-Za-z_][A-Za-z0-9_]{0,63}$.

## Fix

No fixed version published. Mitigate: restrict who can sign up or hold org accounts (disable open registration), run Lotus with a least-privilege, non-superuser DB role, and patch locally by enforcing the allowlist regex ^[A-Za-z_][A-Za-z0-9_]{0,63}$ on subscription_filter_keys and subscription_filters[].property_name, and quoting identifiers in the query templates. Consider migrating off Lotus.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115332
- 2026-10-23T23:41:10+00:00 analyst — No fixed version exists: latest release is 0.10.2 (affected, Mar 2023) and upstream main's last commit is Feb 2024, so project looks dormant. Root cause from the researcher report (hackmd, code-derived, no runtime PoC) and the 0.10.2 source: model_serializers.py ~L501-520 validates subscription_filter_keys only by exact-match blacklist of 9 SQL keywords, and the keys are interpolated as bare identifiers into group-by in the *_query_templates.py. Sibling CVEs from the same report: CVE-2026-115330 (custom_sql stacked statements) and CVE-2026-115331 (property_name). No exploitation seen; no community posts searched.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115332

## Documents

- [advisory] VulnCheck: Lotus through 0.10.2 SQL Injection via Subscription Filter Keys https://www.vulncheck.com/advisories/lotus-through-0.10.2-sql-injection-via-subscription-filter-keys
- [describes] Application Security Assessment Report (VULN-004), leediay https://hackmd.io/@leediay/BkUc3WL2Mx
- [describes] Lotus 0.10.2 model_serializers.py (vulnerable validation) https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/serializers/model_serializers.py
- [mentions] uselotus/lotus releases (latest 0.10.2) https://github.com/uselotus/lotus/releases

## From the sources

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant database.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_