Filecoin-project vulnerabilities

Products

• Lotus 7
• Filecoin-pin 2
• Go-f3 2

Newest

• filecoin-project filecoin-pin Filecoin Pin: Unbounded DAG pinning can exhaust filecoin-pin server resources CVE-2026-62300 Fix available 6.5 MediumOctober 30, 2026
• filecoin-project filecoin-pin Filecoin Pin: Fork bypass in the privileged GitHub Actions workflow CVE-2026-58412 8.2 HighOctober 30, 2026
• filecoin-project lotus Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint CVE-2026-115334 7.6 HighOctober 22, 2026
• filecoin-project lotus Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix CVE-2026-115333 8.2 HighOctober 22, 2026
• filecoin-project lotus Lotus through 0.10.2 SQL Injection via Subscription Filter Keys CVE-2026-115332 8.7 HighOctober 22, 2026
• filecoin-project lotus Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters CVE-2026-115331 8.7 HighOctober 22, 2026
• filecoin-project lotus Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics CVE-2026-115330 8.7 HighOctober 22, 2026
• filecoin-project lotus Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet CVE-2026-115329 6.0 MediumOctober 22, 2026
• filecoin go-f3 go-f3 module vulnerable to integer overflow leading to panic CVE-2025-59942 Fix available 7.5 HighSeptember 29, 2025
• filecoin go-f3 go-f3 is Vulnerable to Cached Justification Verification Bypass CVE-2025-59941 Fix available 5.9 MediumSeptember 29, 2025
• filecoin lotus BLS Signature "Malleability" CVE-2021-21405 Fix available 5.9 MediumApril 15, 2021