CRITICAL 9.8 NVD
CVE-2026-105038
The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated
The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.
References
- https://github.com/xn0tsa/your-secrets-are-safe-with-me
- https://takeonme.org/gcves/GCVE-1337-2026-000000000000001110011111111111111110000000000000
- https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab
This critical severity vulnerability with a CVSS score of 9.8 was published on 2026-10-15 via NVD.
Risk Timeline
CVE Disclosed2026-10-15 · -1 days ago
Remediation Resources
vulnfeed aggregates 14677 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.