Lotus: Improper authentication via event ingestion API key prefix
Summary
Lotus through 0.10.2 has an authentication flaw in its Go event ingestion middleware. The middleware validates API keys by prefix only and does not check the secret against the stored hashed key. An attacker who knows or obtains a valid API key prefix can submit usage events to POST /api/track/ as that organization and alter its metered usage and billing data.
Affected
- Lotus (uselotus/lotus) versions 0 through 0.10.2
- Vendor data lists versions up to and including 0.10.2 as affected; default configuration is unaffected per the CVE record
Fixed in
Unknown.
Workaround
- No vendor-published workaround found.
- Restrict access to POST /api/track/ to trusted internal services.
- Rotate API keys of affected organizations.
Exploitation
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- No known exploitation reported.
- Public technical write-up exists; a public proof of concept has not been verified.
Our recommendation
- Check whether Lotus is in use, and identify the version and whether the ingestion endpoint is reachable from untrusted networks.
- Restrict network access to the ingestion endpoint and rotate API keys.
- Monitor usage and billing data for unexpected event spikes.
- Watch the upstream repository for a fixed release and update promptly.
- Review the other Lotus CVEs published the same day as part of the same patch planning.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Lotus source code repository github.com
- Vulnerable code at tag 0.10.2 github.com
- Researcher write-up hackmd.io
- VulDB entry vuldb.com
- HOL Guard CVE entry hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:12.
Original description (NVD)
Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.