CVE-2026-112014: Use of Hard-coded Cryptographic Key in netease-youdao LobsterAI
Description
LobsterAI versions before 2026.10.16 contain a vulnerability due to a hardcoded cryptographic key. This flaw allows attackers who obtain a provider's export file to decrypt all third-party AI provider API keys by deriving the AES-GCM key using the embedded salt and a constant password. The vulnerability has a medium severity score of 6.8 CVSS 4.0.
CVSS v4.0
Score 6.8medium
Affected software
netease-youdao
LobsterAI
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-112014 describes a hardcoded password vulnerability in netease-youdao's LobsterAI product prior to version 2026.10.16. The product uses a constant string 'lobsterai-APP' as part of the cryptographic key derivation process. Attackers with access to a provider's exported file can use the embedded salt and the constant password to derive the AES-GCM key via PBKDF2, enabling them to decrypt all third-party AI provider API keys contained in the export. This compromises the confidentiality of these API keys.
Potential Impact
Attackers who obtain a provider's export file can decrypt all third-party AI provider API keys, potentially exposing sensitive credentials and enabling unauthorized access to third-party AI services. This compromises the confidentiality of these keys but does not indicate privilege escalation or code execution.
Mitigation Recommendations
A fixed version of LobsterAI is available starting from 2026.10.16. Users should upgrade to version 2026.10.16 or later to remediate this vulnerability. No additional mitigation steps are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-18T01:23:59.312Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad4b23c2cdf04f65664e4bf
Added to database: 10/18/2026, 11:49:16 UTC
Last enriched: 10/18/2026, 12:03:53 UTC
Last updated: 10/18/2026, 19:55:32 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.