CVE-2026-105038: EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching
The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker able to reach the affected FastAPI AI inference or profiling service can exploit it. No privileges or user interaction are required.
What capabilities does exploitation provide?
An attacker can modify AI model configuration and switch the model being used at runtime. The reported impact includes high confidentiality, integrity, and availability impact.
Are both listed products affected?
The issue applies to EnergizeLab Eilik and EnergizeLab EilikO FastAPI AI inference and profiling services, where the model administration functions are exposed without authentication.