CVE-2026-105039

Summary

A role-checking flaw in EnergizeLab's station-middleware Docker images allows low-privilege authenticated users to access administrative APIs and retrieve sensitive AI provider keys. This creates a critical privilege escalation vulnerability where any user can modify configuration and object-store contents.

Exploitability

Exploitation is straightforward requiring only an authenticated user account with minimal prerequisites, as the application fails to validate user roles before allowing access to administrative endpoints.

Blast radius

The impact could be severe across multiple systems as attackers could access AI provider keys, modify configurations, and alter object-store contents, potentially compromising entire AI workflows and data integrity.

Detection

Monitor for unauthorized access attempts to administrative endpoints by low-privilege users in application logs, specifically looking for API calls to configuration and object-store modification endpoints that would normally require elevated privileges.

Prioritized remediation

Upgrade to station-middleware Docker images version 1.8.3 or later to address the role validation flaw in administrative APIs.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.