Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-112014: LobsterAI export files can be decrypted with built‑in password

CVE-2026-112014 · published 17 days ago

Summary

Versions of LobsterAI released before October 16, 2026 use a fixed password to protect exported provider API keys. If someone obtains an exported file, they can use that password to unlock and view all the third‑party AI service keys stored in it. Upgrade to the latest version or apply the vendor's fix and limit distribution of export files to prevent this exposure.

What to do

Update netease-youdao lobsterai to version 2026.10.16 or later.

Affected software

Vendor	Product	Affected versions
netease-youdao	lobsterai	< 2026.10.16

Original advisory text

LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export

LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover every third-party AI provider API key.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-1120... Vendor Advisory
https://github.com/netease-youdao/LobsterAI Product
https://github.com/netease-youdao/LobsterAI/blob/2026.9.23/src/renderer/componen... Third Party Advisory
https://github.com/netease-youdao/LobsterAI/blob/2026.9.23/src/renderer/constant... Third Party Advisory
https://github.com/netease-youdao/LobsterAI/commit/1eb28c40d7e42d6cbade07874e6f6... Patch
https://github.com/netease-youdao/LobsterAI/releases/tag/2026.10.16 Vendor Advisory
https://github.com/netease-youdao/LobsterAI/issues/2851 Third Party Advisory
https://www.vulncheck.com/advisories/lobsterai-before-2026.10.16-hardcoded-passw... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-112014 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.3 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-321Use of Hard-coded Cryptographic Key

Timeline

Published18 Oct 2026

Updated26 Oct 2026

First seen18 Oct 2026

Sources

CVE-2026-112014 · NVD

CVE-2026-112014 · MITRE

CVE-2026-112014 · OSV

Track software like this

Free during beta