User Role Bypass in EnergizeLab Middleware Docker Images
CVE-2026-105039

9.6CRITICAL

Key Information:

Vendor

Energizelab

Status
Station-middleware
Vendor
CVE Published:
15 October 2026

What is CVE-2026-105039?

The EnergizeLab station-middleware Docker images versions 1.6.5 to 1.8.2 exhibit a serious flaw whereby authentication mechanisms do not adequately enforce user roles on administrative APIs. As a result, low-privilege users may gain unauthorized access to sensitive AI provider keys and alter critical configuration settings, along with object-store content, leading to potential data exposure and manipulation. This vulnerability necessitates immediate awareness and corrective action by affected users to safeguard against unauthorized data access.

Affected Version(s)

station-middleware 1.6.5 <= 1.8.2

References

https://github.com/xn0tsa/your-secrets-are-safe-with-me
technical-description
https://takeonme.org/gcves/GCVE-1337-2026-000000000000001...
third-party-advisory
https://www.theverge.com/tech/1010727/eiliko-robot-hack-e...
media-coverage

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sammy Azdoufal
todb of AHA!
.