CVE-2026-105038

Deferred Deferred - Pending Action

Unauthenticated Model Switch in Eilik FastAPI Services

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: Austin Hackers Anonymous

Description

The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105038

Affected Vendors & Products

Vendor	Product	Version / Range
EnergizeLab	FastAPI	AI inference server n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services have AI model administration functions that are accessible without authentication. An attacker can remotely access these functions to change AI model configurations or switch the active model during runtime without needing credentials.

Detection Guidance

Check for open ports 8000 or 8001 on systems running EnergizeLab Eilik or EilikO services. Use nmap -p 8000,8001 <target_IP> to scan. Inspect FastAPI service logs for unauthorized model configuration changes or runtime model switches.

Impact Analysis

An unauthenticated attacker could alter AI model behavior, leading to incorrect outputs, data breaches, or system manipulation. This could disrupt services, compromise sensitive data, or allow further attacks on connected systems.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to AI systems, potentially leading to data exposure or integrity issues. GDPR and HIPAA require strict access controls; this flaw undermines those controls, risking regulatory penalties.

Mitigation Strategies

Immediately restrict network access to the FastAPI services using firewalls or network segmentation. Disable unauthenticated admin functions if possible. Update to a patched version once available. Monitor logs for suspicious activity.

Hi! I’m here to help you understand CVE-2026-105038. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70