CVE-2026-105038
CVE-2026-105038 · EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.
CVSS 9.8 · Critical · EPSS 0.6%
- Published
- Updated
Affected products and versions
fastapi ai inference server
- Versions
- n/a: Affected
No fix published
Original sources
- https://github.com/xn0tsa/your-secrets-are-safe-with-me
- https://takeonme.org/gcves/GCVE-1337-2026-00000000000000111001111111111111111000000000000000000011111100100111111110000000000000000000011111111111111100000000000000000010010/
- https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab
- https://nvd.nist.gov/vuln/detail/CVE-2026-105038