Live › vulnerability › CVE-2026-112014
Go to dashboardLobsterAI before 2026.10.16 encrypts exported provider API keys with a constant password, 'lobsterai-APP', that is embedded in the software. An attacker who obtains an exported providers file can derive the decryption key and recover every stored third-party AI provider API key.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that use LobsterAI before version 2026.10.16 and export provider settings, since the export file holds the provider API keys encrypted with a password that is hardcoded in the product. Anyone who can read such an export file can recover the keys, so the risk depends on where those files are stored and shared. Teams on 2026.10.16 or later, or that never export providers, can skip the key rotation step.
No product ranges from the sources yet.
2026.10.162026.10.16 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover every third-party AI provider API key.
This page as .md · .json · in your agent: get_signal("CVE-2026-112014")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.