CVE-2026-115331: Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric propertyname or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to access the database shared by all tenants.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated organization user can exploit it by supplying crafted billable metric property_name values or categorical filter values. No user interaction is required.
What data or systems could be exposed?
The injected SQL is executed against the database shared by all tenants. Successful exploitation may allow access to that shared database and can affect confidentiality, integrity, and availability.
Which metric query types are affected?
Counter, gauge, and rate metric queries are affected where the relevant values are rendered unescaped into Jinja-generated SQL queries.
How can an organization determine whether it may be affected?
Organizations using Lotus through version 0.10.2 should review whether authenticated users can create or modify billable metric property names or categorical filters. Review those values for crafted SQL-like input and inspect the generated counter, gauge, and rate metric queries for unescaped interpolation.