EnergizeLab has 9 CVEs on record. Disclosure cadence is accelerating: 9 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 9. The median CVSS is 8.8 (high), with 4 rated critical. None have a confirmed exploitation report. Most affected products: FastAPI AI inference server (2), NestJS auth service (2), station-middleware (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.8
- Publish → KEV
- —
- Last 90 days
- 9 prev 0
Products
- FastAPI AI inference server 2
- NestJS auth service 2
- station-middleware 2
- AI Station firmware (RK3562) 1
- FirmwareUpdater 1
- Robot firmware (mode 104000) 1
Worst active — by depth score
CVE-2026-105038Critical· 9.8EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching54CVE-2026-105037Critical· 9.9EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read54CVE-2026-105039Critical· 9.6EnergizeLab Station Middleware Admin APIs Missing Role Checks53CVE-2026-105032Critical· 9.1EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write50CVE-2026-105040High· 8.8EnergizeLab Eilik User-ID Mass Assignment Account Takeover48
EnergizeLab vulnerabilities
CVEs affecting EnergizeLab, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
CVE-2026-105032Critical· 9.1EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write
The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use …
CVE-2026-105038Critical· 9.8EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching
The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in us…
CVE-2026-105035High· 7.8EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key
The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any…
CVE-2026-105034High· 8.2EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device aga…
CVE-2026-105033High· 8.8EnergizeLab AI Station Default Root Credentials with SSH Enabled
The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it.
CVE-2026-105039Critical· 9.6EnergizeLab Station Middleware Admin APIs Missing Role Checks
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.
CVE-2026-105037Critical· 9.9EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files an…
CVE-2026-105040High· 8.8EnergizeLab Eilik User-ID Mass Assignment Account Takeover
The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.
CVE-2026-105036High· 7.5EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks
EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attac…