HIGH 8.7 NVD
CVE-2026-115331
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric pro
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to access the database shared by all tenants.
References
- https://github.com/uselotus/lotus
- https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/aggregation/counter
- https://hackmd.io/@leediay/BkUc3WL2Mx
- https://www.vulncheck.com/advisories/lotus-through-0.10.2-sql-injection-via-metric-propert
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-10-22 via NVD.
vulnfeed aggregates 17299 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.