{"id":"CVE-2026-105038","published":"2026-10-15T21:17:04.467","lastModified":"2026-10-16T20:17:18.490","description":"The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/xn0tsa/your-secrets-are-safe-with-me","tags":[]},{"url":"https://takeonme.org/gcves/GCVE-1337-2026-00000000000000111001111111111111111000000000000000000011111100100111111110000000000000000000011111111111111100000000000000000010010/","tags":[]},{"url":"https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab","tags":[]}],"exploitRefs":[{"url":"https://github.com/xn0tsa/your-secrets-are-safe-with-me","tags":[]}],"hasPoc":true,"ai":{"summary":"An unauthenticated attacker can remotely modify AI model configurations and switch models at runtime in EnergizeLab Eilik and EilikO services, leading to potential data compromise and service disruption.","exploitability":"Exploitation is straightforward with no prerequisites, as the vulnerability allows immediate access to administrative functions without any authentication requirements.","blast_radius":"The impact could be severe across all systems using these AI inference services, potentially allowing attackers to manipulate model outputs, inject malicious data processing, or cause service outages.","remediation":"Disable the exposed AI model administration endpoints until a patched version is available, or restrict access to these endpoints via network segmentation and authentication controls.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","api","ai","unauthenticated-access"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:46:14.375Z"}}