CVE-2026-115333 Details

A vulnerability exists in Lotus versions through 0.10.2, where the Go event ingestion middleware improperly authenticates API keys. The middleware validates API keys by prefix only, without verifying the secret against the stored hashed key. This flaw allows attackers who know or obtain an API key prefix to submit usage events to the '/api/track/' endpoint on behalf of that organization, thereby altering its metered usage and billing. The issue arises because the authentication process in the Go middleware fails to implement a crucial verification step, creating a loophole that can be exploited to manipulate usage data and associated costs for the affected organization.

The vulnerability can be remediated by updating the authentication middleware to verify the full API key, including the secret, against the stored hashed key. This can be done by hashing the presented key and comparing it to the stored hash using a constant-time comparison to prevent timing attacks.