by Kastro
Paper/Archive/CVE-2026-105038

CVE-2026-105038

EnergizeLab FastAPI AI inference server — EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 50.9.509 × 2010.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.

Affected

ProductAffectedFixed inSource
FastAPI AI inference servern/a–CNA

Scores by source

AHA (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupgithub.com/xn0tsa/your-secrets-are-safe-with-mewriteuptakeonme.org/gcves/GCVE-1337-2026-00000000000000111001111111111111111000000000000000000011111100100111111110000000000000000000011111111111111100000000000000000010010reftheverge.com/tech/1010727/eiliko-robot-hack-energize-lab