CVE-2026-112014 LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export
Attackers can decrypt exported provider API keys using a hardcoded password, exposing sensitive third-party AI credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-112014?
CVE-2026-112014 is a medium-severity vulnerability in netease-youdao LobsterAI, published on 18 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover every third-party AI provider API key.
Weakness: CWE-321
Which versions are affected by CVE-2026-112014?
How do I fix CVE-2026-112014?
No fix has been published for CVE-2026-112014 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-112014 being exploited?
There is no known exploitation of CVE-2026-112014 in the wild and no public exploit code.
Sources
Also known as GHSA-rpw3-ccp2-4v8w.