{"id":"CVE-2026-115333","kind":"vulnerability","aliases":["CVE-2026-115333"],"related":[],"title":"Lotus: event ingestion accepts API key prefix alone, skipping secret check","description":"Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.","summary":"Lotus through 0.10.2 checks only the prefix of an API key on its Go event ingestion middleware and never compares the secret against the stored hash. An attacker who knows or obtains a key prefix can post usage events to POST /api/track/ as that organization, changing its metered usage and billing.","severity":"high","cvss":8.2,"epss":0.00299,"exploited":false,"exploited_at":null,"products":[{"name":"lotus","fixed":[],"affected":"<= 0.10.2","ecosystem":"github"}],"ecosystems":[],"tags":["api-key","billing","go","lotus","other","self-hosted"],"not_affected_if":["managed-hosting","private-network","unknown"],"how_to_check":"Self-hosted Lotus <= 0.10.2 running the Go event-ingestion service (go/event-ingestion): check the image/tag. Confirm in go/event-ingestion/authn/authn.go that the middleware queries by prefix only and never compares hashed_key. Check whether POST /api/track/ is exposed to the internet and review events for unexpected usage per organization.","fix":"No fixed version published as of 2026-10-25 (latest release 0.10.2). Workaround: restrict network access to /api/track/ to trusted clients, or patch authn.go to compare the key secret against hashed_key, and rotate API keys if the prefix may have leaked.","status":"open","published_at":"2026-10-22T11:17:52+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:03:41+00:00","updated_at":"2026-10-25T03:19:40+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-25T03:03:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Lotus: event ingestion accepts API key prefix alone, skipping secret check","impact":"medium","summary":"Lotus through 0.10.2 checks only the prefix of an API key on its Go event ingestion middleware and never compares the secret against the stored hash. An attacker who knows or obtains a key prefix can post usage events to POST /api/track/ as that organization, changing its metered usage and billing.","category":"other","nicknames":[],"who_cares":["lotus","self-hosted","billing"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker forges usage events, altering an organization's metered billing","analyst_note":"Check the NVD entry and the Lotus repository for a fixed version and whether POST /api/track/ is reachable by default.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running Lotus 0.10.2 or earlier that use its usage tracking endpoint for metered billing. The sources do not say whether managed hosting is affected or whether the endpoint is exposed by default.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000552,"input_tokens":3370,"output_tokens":430,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the Lotus repository for a fixed version and whether POST /api/track/ is reachable by default.","search":"'-115333':14A,17A '-2026':13A,16A '/api/track':70B,125C '0.10.2':31B,82C 'accept':4A 'alon':8A 'alter':129C 'api':5A,20B,38B,96C,116C 'api-key':19B 'attack':56B,110C 'authent':86C 'bill':22B,79B,134C 'chang':74B 'check':11A,32B,102C 'compar':48B 'contain':83C 'cve':12A,15A 'event':2A,43B,67B,91C,122C 'go':23B,42B,90C 'hash':54B,108C 'host':28B 'improp':85C 'ingest':3A,44B,92C 'key':6A,21B,39B,62B,97C,109C,117C 'know':58B,112C 'lotus':1A,18A,24B,29B,80C 'meter':76B,131C 'middlewar':45B,93C 'never':47B 'obtain':60B,114C 'organ':73B,128C 'post':65B,69B,124C 'prefix':7A,35B,63B,99C,118C 'secret':10A,50B,104C 'self':27B 'self-host':26B 'skip':9A 'store':53B,107C 'submit':120C 'usag':66B,77B,121C,132C 'valid':95C 'vulner':87C 'without':101C","nicknames":[],"mitigations":[],"who_affected":"Teams self-hosting Lotus (usage-based billing) with the Go event-ingestion service reachable from untrusted networks. An attacker needs a valid 8-character key prefix of a target organization; they can then post forged usage events, changing metered usage and invoices. Teams not self-hosting, or keeping /api/track/ on a private network, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115333","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115333","severity":null,"published_at":"2026-10-22T11:17:52+00:00","modified_at":"2026-10-23T15:17:28+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115333","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115333","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115333:694","url":null,"severity":null,"published_at":"2026-10-25T03:19:40+00:00","modified_at":"2026-10-25T03:19:40+00:00","first_seen_at":"2026-10-25T03:19:40+00:00","fetched_at":"2026-10-25T03:19:40+00:00","note":"Read vulnerable authn.go at 0.10.2 (prefix-only DB lookup, hashed_key never compared) and the reporter's audit; no vendor advisory, no fixed release (latest is 0.10.2), no exploitation or PoC seen. Nothing marked verified."}],"documents":[{"id":3122,"url":"https://github.com/uselotus/lotus/blob/0.10.2/go/event-ingestion/authn/authn.go","title":"lotus 0.10.2 authn.go (vulnerable middleware)","kind":"other","source":"analyst","text":"Middleware cuts key at first '.', queries metering_billing_apitoken WHERE prefix=$1 AND revoked=false, validates revoked/expiry only; hashed_key is selected but never compared with the secret. Result cached by full key string.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2112,"url":"https://hackmd.io/@leediay/BkUc3WL2Mx","title":"Application Security Assessment Report (VULN-004), leediay","kind":"advisory","source":"analyst","text":"Third-party static audit: VULN-004 Go event-ingestion authenticates by 8-char prefix only; POST /api/track/; status Partially Verified (code-derived, not executed).","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2115,"url":"https://github.com/uselotus/lotus/releases","title":"uselotus/lotus releases (latest 0.10.2)","kind":"release","source":"analyst","text":"Latest release 0.10.2 (23 Mar). No release notes mention an authn fix.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}