CVE-2026-115332

HIGH

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant database.

CVSS v3.1 Score

8.8
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Published: 10/22/2026Modified: 10/29/2026

Related Intelligence (1)

HIGHVulnerability

NVD HIGH: CVE-2026-115332 — Lotus through 0.10.2 contains an sql injection vulnerability that allows authent...

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant data

CVE-2026-115332
NIST NVD

References (5)

https://github.com/uselotus/lotushttps://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/serializers/model_serializers.py#L518-L534https://hackmd.io/@leediay/BkUc3WL2Mxhttps://www.vulncheck.com/advisories/lotus-through-0.10.2-sql-injection-via-subscription-filter-keyshttps://hackmd.io/@leediay/BkUc3WL2Mx