CVE-2026-112014: LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export
LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover every third-party AI provider API key.
Affected Software
Event History
Frequently Asked Questions
What must an attacker obtain to recover the provider API keys?
An attacker needs a providers export file. With that file, the hardcoded password, and the embedded salt, they can derive the AES-GCM key using PBKDF2 and decrypt every exported third-party AI provider API key.
Which deployments are affected?
LobsterAI versions before 2026.10.16 are affected. The issue concerns provider API keys included in exported providers files.
What is the practical impact if an export file is exposed?
Exposure can reveal every third-party AI provider API key stored in the export. Those keys should be treated as compromised and rotated with their respective providers.