CVE-2026-112014 Details
Description
LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover every third-party AI provider API key.
A vulnerability exists in LobsterAI versions prior to 2026.10.16, where a hardcoded password is used to encrypt provider API keys in exported files. This vulnerability allows attackers to decrypt the API keys using the constant 'lobsterai-APP'. The encryption is performed with AES-GCM, and the same password is used for decryption when the file is imported. Since the password is public and constant across all installations, anyone with access to the export file can easily retrieve the API keys it contains.
Users can update to LobsterAI version 2026.10.16 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-321 | Use of Hard-coded Cryptographic Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| netease-youdao LobsterAI | >= 0, < 2026.10.16 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |