CVE-2026-115333: Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix
Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashedkey. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker who knows or obtains an organization's API key prefix can exploit it. The attacker does not need a full valid API key or user interaction.
What impact can successful exploitation have?
An attacker can submit usage events to POST /api/track/ as the affected organization. This can alter that organization's metered usage and billing.
Which deployments are affected?
Lotus versions through 0.10.2 are affected. The issue is in the Go event-ingestion middleware's API-key validation path.