Skip to content
Heist/ feed
High

Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix

Type: advisorySource: Official CVE List1 source record

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.

Announced Source revision 1
Original source ↗

CVE-2026-115333

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-115333

lotus

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "uselotus",
    "product": "lotus",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "0.10.2"
      }
    ],
    "packageURL": "pkg:github/uselotus/lotus",
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-115333

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#53029 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement