Hardcoded Password Vulnerability in LobsterAI Affects API Security

CVE-2026-112014

What is CVE-2026-112014?

LobsterAI versions prior to 2026.10.16 contain a vulnerability due to the presence of a hardcoded password. This flaw allows unauthorized attackers who gain access to the exported provider API keys to decrypt sensitive information. By leveraging the constant 'lobsterai-APP', attackers can derive the AES-GCM key employed in the encryption process through PBKDF2 using an embedded salt. This can result in the recovery of critical third-party AI provider API keys, posing a significant risk of data breaches and unauthorized access to external services.

References