Vulnerability · Published Oct 22, 2026 · Assigned by VulnCheck
CVE-2026-115333Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix
Medium 5.9
In plain English
A medium-severity improper authentication in lotus from uselotus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.4%top 69.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.
Affected products (as reported)
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://hackmd.io/@leediay/BkUc3WL2Mx technical-description
- https://github.com/uselotus/lotus/blob/0.10.2/go/event-ingestion/authn/authn.go#L85-L95 technical-description
- https://github.com/uselotus/lotus product
- VulnCheck Advisory: Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix third-party-advisory