Live › vulnerability › CVE-2026-115333
Go to dashboardLotus through 0.10.2 checks only the prefix of an API key on its Go event ingestion middleware and never compares the secret against the stored hash. An attacker who knows or obtains a key prefix can post usage events to POST /api/track/ as that organization, changing its metered usage and billing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams self-hosting Lotus (usage-based billing) with the Go event-ingestion service reachable from untrusted networks. An attacker needs a valid 8-character key prefix of a target organization; they can then post forged usage events, changing metered usage and invoices. Teams not self-hosting, or keeping /api/track/ on a private network, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| lotus | github | <= 0.10.2 | – |
0.10.2 running the Go event-ingestion service (go/event-ingestion): check the image/tag0.10.2)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.
This page as .md · .json · in your agent: get_signal("CVE-2026-115333")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.