Improper Authentication in Lotus Event Ingestion Middleware by Usualsuspect

CVE-2026-115333

What is CVE-2026-115333?

Lotus versions up to 0.10.2 are vulnerable due to an improper authentication flaw within the Go event ingestion middleware. This vulnerability arises from the system’s reliance on only validating API key prefixes, without verifying the corresponding secret against the stored hashed key. As a result, attackers who gain knowledge of an API key prefix can exploit the vulnerability to submit unauthorized usage events to the POST /api/track/ endpoint. This could lead to unauthorized modifications of the organization’s metered usage and billing information, potentially causing significant financial discrepancies.

References