HIGH 8.7 NVD
CVE-2026-115332
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filt
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant database.
References
- https://github.com/uselotus/lotus
- https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/serializers/model_s
- https://hackmd.io/@leediay/BkUc3WL2Mx
- https://www.vulncheck.com/advisories/lotus-through-0.10.2-sql-injection-via-subscription-f
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-10-22 via NVD.
vulnfeed aggregates 17299 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.