{"id":"CVE-2026-112014","title":"LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export","summary":"LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the …","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-321"],"vendor":"netease-youdao","product":"LobsterAI","affected":["LobsterAI < 2026.10.16"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T11:38:35.397Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112014","references":[{"url":"https://github.com/netease-youdao/LobsterAI/issues/2851"},{"url":"https://github.com/netease-youdao/LobsterAI/blob/2026.9.23/src/renderer/constants/app.ts#L4"},{"url":"https://github.com/netease-youdao/LobsterAI/blob/2026.9.23/src/renderer/components/Settings.tsx#L4324-L4331"},{"url":"https://github.com/netease-youdao/LobsterAI/commit/1eb28c40d7e42d6cbade07874e6f6c068b6a9a64"},{"url":"https://github.com/netease-youdao/LobsterAI/releases/tag/2026.10.16","label":"LobsterAI 2026.10.16 Release Notes"},{"url":"https://www.vulncheck.com/advisories/lobsterai-before-2026.10.16-hardcoded-password-in-provider-api-key-export","label":"VulnCheck Advisory: LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T11:40:26.620Z","slug":"CVE-2026-112014","body":"## Overview\n\nLobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover every third-party AI provider API key.\n\n## Affected\n\n- `LobsterAI < 2026.10.16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}