CVE-2026-115333

5.9 MEDIUMpublic exploit available

Published 2026-10-22 · Updated 2026-10-23

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses

CWE-287

Public exploit & PoC references

https://github.com/uselotus/lotus
https://github.com/uselotus/lotus/blob/0.10.2/go/event-ingestion/authn/authn.go#L85-L95

All references

https://github.com/uselotus/lotus
https://github.com/uselotus/lotus/blob/0.10.2/go/event-ingestion/authn/authn.go#L85-L95
https://hackmd.io/@leediay/BkUc3WL2Mx
https://www.vulncheck.com/advisories/lotus-through-0.10.2-improper-authentication-via-event-ingestion-api-key-prefix

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2025-43936
MEDIUMCVE-2026-100143
HIGHCVE-2026-100163
UNSCOREDCVE-2026-100169PoC
HIGHCVE-2026-100606PoC
HIGHCVE-2026-100607PoC
HIGHCVE-2026-100684PoC
HIGHCVE-2026-100709PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.