Key points
- Lotus versions up to 0.10.2 contain a high-severity SQL injection vulnerability.
- Authenticated organization users can execute arbitrary SQL by appending statements to custom metric queries.
- The flaw allows attackers to read or modify data across all tenants via the /app/metrics/ endpoint.
Lotus versions through 0.10.2 are affected by CVE-2026-115330, a high-severity SQL injection flaw. According to the National Vulnerability Database, this issue allows authenticated organization users to execute arbitrary SQL commands. No patch has been confirmed yet. Security teams must assess their exposure immediately, as the vulnerability permits cross-tenant data access.
In plain English
The vulnerability exists because Lotus fails to properly restrict SQL input in custom metric queries. Attackers can append additional SQL statements after a semicolon, bypassing validation that only checks the first statement. This allows them to run stacked queries through the POST /app/metrics/ endpoint. Consequently, malicious users can read or modify data belonging to other tenants within the same system.
The background
The National Vulnerability Database rates CVE-2026-115330 as a CVSS 8.7 high severity issue. The weakness is classified under CWE-89, which covers SQL injection flaws. The affected software is developed by uselotus. The vulnerability impacts all versions of Lotus up to and including 0.10.2. There is no mention of a fix or mitigation in the source record.
What changes now
Organizations using Lotus must treat this as a critical risk due to the cross-tenant nature of the attack. Since authenticated users can exploit the flaw, internal threat actors or compromised accounts pose a significant danger. Teams should audit access to the /app/metrics/ endpoint. Without a vendor patch, the primary defense is limiting who can create custom metric queries.
Who needs to act first
Security operations teams should prioritize systems exposed to internet-facing users or those with high-value data. Identify all instances of Lotus running version 0.10.2 or earlier. Check if any users have permissions to create custom metric queries. Restrict access to the metrics endpoint where possible. Monitor logs for unusual SQL patterns or semicolon usage in query parameters. Prepare to isolate affected systems if malicious activity is detected.
What to do and how to stay safe: Lotus
- Audit user permissions to identify who can create custom metric queries in Lotus.
- Restrict network access to the /app/metrics/ endpoint to trusted internal networks only.
- Monitor application logs for semicolons in query parameters, which may indicate injection attempts.
- Isolate affected Lotus instances from production databases until a vendor patch is available.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Lotus versions are affected by CVE-2026-115330?
All versions of Lotus up to and including 0.10.2 are affected by this SQL injection vulnerability.
Is there a patch available for this vulnerability?
No fix has been confirmed yet according to the National Vulnerability Database record.
How can an attacker exploit this flaw?
Authenticated users can submit semicolon-separated SQL through the POST /app/metrics/ endpoint to execute arbitrary commands.
