CVE-2026-105038

critical · 9.8

The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.

9.8

CVSS

0.6%

EPSS (exploit prob.)

51st

EPSS percentile

2026-10-15

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-306

References

https://github.com/xn0tsa/your-secrets-are-safe-with-me
https://takeonme.org/gcves/GCVE-1337-2026-00000000000000111001111111111111111000000000000000000011111100100111111110000000000000000000011111111111111100000000000000000010010/
https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-105038