CVE-2026-105038
9.8CriticalPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-306
Impact
Unauthenticated remote attackers can reconfigure models and swap the active AI model at runtime. All an attacker needs is network access to the exposed FastAPI services.
Root cause
The FastAPI inference and profiling endpoints expose model administration functions without enforcing authentication.
Affected systems
EnergizeLab Eilik and EilikO (versions not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to a fixed version once EnergizeLab releases one; until then, block network access to the FastAPI AI inference and profiling ports or isolate the devices on a restricted VLAN.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.