PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-115332 uselotus CVE debrief

A SQL injection vulnerability exists in Lotus through version 0.10.2, allowing authenticated organization users to inject malicious SQL by registering crafted subscription_filter_keys. This can lead to SQL injection in usage aggregation queries against the shared multi-tenant database. The vulnerability requires attention from defenders responsible for systems using this version, as it can lead to potential SQL injection in usage aggregation queries. Defenders should assess exposure and prioritize remediation.

Vendor
uselotus
Product
lotus
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-29
Advisory published
2026-10-22
Advisory updated
2026-10-29

Who should care

Defenders responsible for systems using Lotus version 0.10.2 or earlier should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify and remediate this vulnerability in their systems.

Why it matters

The SQL injection vulnerability in Lotus through version 0.10.2 requires attention from defenders responsible for systems using this version, as it can lead to potential SQL injection in usage aggregation queries.

  • Potential SQL injection in usage aggregation queries
  • Possible unauthorized access to sensitive data
  • Required verification of Lotus version and exposure
  • Necessity for input validation and sanitization

Technical summary

The SQL injection vulnerability in Lotus through version 0.10.2 allows authenticated organization users to inject malicious SQL by registering crafted subscription_filter_keys. This can lead to SQL injection in usage aggregation queries against the shared multi-tenant database. The vulnerability is caused by the lack of proper input validation and sanitization of subscription_filter_keys. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their systems, especially those using Lotus version 0.10.2 or earlier.

Recommended defensive actions

  • Verify the version of Lotus being used and assess exposure
  • Implement input validation and sanitization for subscription_filter_keys
  • Monitor for suspicious activity and potential SQL injection attempts
  • Apply patches or updates to Lotus as they become available
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details about the SQL injection vulnerability in Lotus through version 0.10.2. The vulnerability allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-115332 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-115332

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-115332 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-115332

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Lotus through 0.10.2 SQL Injection via Subscription Filter Keys

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115332.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@leediay/BkUc3WL2Mx

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/serializers/model_serializers.py

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/uselotus/lotus

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/lotus-through-0.10.2-sql-injection-via-subscription-filter-keys

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.