CVE-2026-112014
MEDIUM
6,8
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
5,5
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none
Description
AI Translation Available
LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover every third-party AI provider API key.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0013
Percentile
0,0th
Updated
EPSS Score Trend (Last 2 Days)
321
Use of Hard-coded Cryptographic Key
DraftCommon Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism
Gain Privileges Or Assume Identity
Read Application Data
Applicable Platforms
Technologies:
ICS/OT
https://github.com/netease-youdao/LobsterAI/blob/2026.9.23/src/renderer/compone…
https://github.com/netease-youdao/LobsterAI/blob/2026.9.23/src/renderer/constan…
https://github.com/netease-youdao/LobsterAI/commit/1eb28c40d7e42d6cbade07874e6f…
https://github.com/netease-youdao/LobsterAI/issues/2851
https://github.com/netease-youdao/LobsterAI/releases/tag/2026.10.16
https://www.vulncheck.com/advisories/lobsterai-before-2026.10.16-hardcoded-pass…