CVE-2026-105038

Summary

An unauthenticated attacker can remotely modify AI model configurations and switch models at runtime in EnergizeLab Eilik and EilikO services, leading to potential data compromise and service disruption.

Exploitability

Exploitation is straightforward with no prerequisites, as the vulnerability allows immediate access to administrative functions without any authentication requirements.

Blast radius

The impact could be severe across all systems using these AI inference services, potentially allowing attackers to manipulate model outputs, inject malicious data processing, or cause service outages.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the exposed AI model administration endpoints until a patched version is available, or restrict access to these endpoints via network segmentation and authentication controls.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.