---
id: CVE-2026-105038
title: >-
  The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services
  expose AI model administration functions without authentication
summary: >-
  The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services
  expose AI model administration functions without authentication. An
  unauthenticated remote attacker can change AI model configuration and switch
  the model in us…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-306
vendor: EnergizeLab
product: FastAPI AI inference server
affected:
  - fastapi_ai_inference_server n/a
published: '2026-10-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:17:18.490'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-105038'
references:
  - url: 'https://github.com/xn0tsa/your-secrets-are-safe-with-me'
    label: cve@takeonme.org
  - url: >-
      https://takeonme.org/gcves/GCVE-1337-2026-00000000000000111001111111111111111000000000000000000011111100100111111110000000000000000000011111111111111100000000000000000010010/
    label: cve@takeonme.org
  - url: 'https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab'
    label: cve@takeonme.org
tags:
  - nvd
  - cve.org
epss: 0.00646
epssPercentile: 0.51105
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T19:54:20.526865Z'
ingestedAt: '2026-10-15T21:45:11.429Z'
---

## Overview

The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.