{"id":"CVE-2026-112014","summary":"LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export","details":"LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover every third-party AI provider API key.","modified":"2026-10-21T02:55:50.208056854Z","published":"2026-10-18T11:38:35.397Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-321"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112014.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112014.json"},{"type":"PACKAGE","url":"https://github.com/netease-youdao/LobsterAI"},{"type":"ARTICLE","url":"https://github.com/netease-youdao/LobsterAI/blob/2026.9.23/src/renderer/components/Settings.tsx#L4324-L4331"},{"type":"ARTICLE","url":"https://github.com/netease-youdao/LobsterAI/blob/2026.9.23/src/renderer/constants/app.ts#L4"},{"type":"FIX","url":"https://github.com/netease-youdao/LobsterAI/commit/1eb28c40d7e42d6cbade07874e6f6c068b6a9a64"},{"type":"REPORT","url":"https://github.com/netease-youdao/LobsterAI/issues/2851"},{"type":"ADVISORY","url":"https://github.com/netease-youdao/LobsterAI/releases/tag/2026.10.16"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112014"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/lobsterai-before-2026.10.16-hardcoded-password-in-provider-api-key-export"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/netease-youdao/lobsterai","events":[{"introduced":"0"},{"fixed":"b649d5c80f25887e6d0c1ff04024150f7476da5d"},{"fixed":"1eb28c40d7e42d6cbade07874e6f6c068b6a9a64"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"0"},{"fixed":"2026.10.16"}]},{"range":[{"fixed":"1eb28c40d7e42d6cbade07874e6f6c068b6a9a64"}],"source":"REFERENCES_COMMIT"},{"original_tag":"2026.10.16","range":[{"fixed":"b649d5c80f25887e6d0c1ff04024150f7476da5d"}],"source":"REFERENCES_TAG"}]}}],"versions":["2026.10.13","2026.9.23","2026.9.22","2026.9.20","2026.9.17","2026.9.15","2026.9.14","2026.9.4","2026.9.3","2026.8.28","2026.8.26","2026.8.18","2026.8.25","2026.8.21","2026.8.14","2026.8.11","2026.8.7","2026.8.5","2026.7.29","2026.7.23","2026.7.17","2026.7.16","2026.7.15","2026.7.10","2026.7.7","2026.7.3","2026.6.30","2026.6.29","2026.6.26","2026.6.18","2026.6.15","2026.6.10","2026.6.5","2026.6.3","2026.6.1","2026.5.27","2026.5.22","2026.5.18","2026.5.14","2026.5.12","2026.5.9","2026.5.7","2026.4.29","2026.4.25","2026.4.24","2026.4.21","2026.4.17","2026.4.13","2026.4.8","2026.4.3","2026.4.1","2026.3.31","2026.3.30","2026.3.29","2026.3.22","2026.3.26","2026.3.25","2026.3.23","2026.3.21","2026.3.20","2026.3.19","2026.3.17","2026.3.16","v0.1.18","v0.1.17","v0.1.16"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112014.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}