---
id: "CVE-2026-115333"
kind: "vulnerability"
aliases: ["CVE-2026-115333"]
title: "Lotus: event ingestion accepts API key prefix alone, skipping secret check"
severity: "high"
cvss: 8.2
epss: 0.00299
exploited: false
status: "open"
category: "other"
products: [{"name": "lotus", "fixed": [], "affected": "<= 0.10.2", "ecosystem": "github"}]
ecosystems: []
tags: ["api-key", "billing", "go", "lotus", "other", "self-hosted"]
not_affected_if: ["managed-hosting", "private-network", "unknown"]
published_at: "2026-10-22T11:17:52+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T03:19:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115333", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115333", "first_seen_at": "2026-10-24T07:15:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:19:40+00:00"}]
---

# Lotus: event ingestion accepts API key prefix alone, skipping secret check

Lotus through 0.10.2 checks only the prefix of an API key on its Go event ingestion middleware and never compares the secret against the stored hash. An attacker who knows or obtains a key prefix can post usage events to POST /api/track/ as that organization, changing its metered usage and billing.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:lotus affected <= 0.10.2 fixed ?

## How to check

Self-hosted Lotus <= 0.10.2 running the Go event-ingestion service (go/event-ingestion): check the image/tag. Confirm in go/event-ingestion/authn/authn.go that the middleware queries by prefix only and never compares hashed_key. Check whether POST /api/track/ is exposed to the internet and review events for unexpected usage per organization.

## Fix

No fixed version published as of 2026-10-25 (latest release 0.10.2). Workaround: restrict network access to /api/track/ to trusted clients, or patch authn.go to compare the key secret against hashed_key, and rotate API keys if the prefix may have leaked.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115333
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115333
- 2026-10-25T03:19:40+00:00 analyst — Read vulnerable authn.go at 0.10.2 (prefix-only DB lookup, hashed_key never compared) and the reporter's audit; no vendor advisory, no fixed release (latest is 0.10.2), no exploitation or PoC seen. Nothing marked verified.

## Documents

- [advisory] Application Security Assessment Report (VULN-004), leediay https://hackmd.io/@leediay/BkUc3WL2Mx
- [describes] lotus 0.10.2 authn.go (vulnerable middleware) https://github.com/uselotus/lotus/blob/0.10.2/go/event-ingestion/authn/authn.go
- [mentions] uselotus/lotus releases (latest 0.10.2) https://github.com/uselotus/lotus/releases

## From the sources

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_