CVE-2026-112014 netease-youdao CVE debrief

Who should care

Defenders responsible for LobsterAI deployments should assess exposure to potential decryption attacks. This includes verifying the use of LobsterAI, checking for the presence of export files, and ensuring that LobsterAI is updated to version 2026.10.16 or later.

Why it matters

CVE-2026-112014 is a hardcoded password vulnerability in LobsterAI that allows attackers to decrypt exported provider API keys. Defenders responsible for LobsterAI deployments should assess exposure and prioritize updating to version 2026.10.16 or later.

• Recovery of third-party AI provider API keys may lead to unauthorized access
• Potential decryption of exported provider API keys requires verification of LobsterAI usage and exposure
• Defenders should prioritize updating LobsterAI to version 2026.10.16 or later

Technical summary

The vulnerability is caused by a hardcoded password used for encrypting provider API keys in LobsterAI before version 2026.10.16. An attacker who obtains a provider's export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover every third-party AI provider API key. This allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Defenders should prioritize verifying the use of LobsterAI and assessing exposure to potential decryption attacks. This involves checking for the presence of export files and ensuring that LobsterAI is updated to version 2026.10.16 or later.

Defensive priority

Defenders should prioritize verifying the use of LobsterAI and assessing exposure to potential decryption attacks. This involves checking for the presence of export files and ensuring that LobsterAI is updated to version 2026.10.16 or later.

Recommended defensive actions

• Verify LobsterAI usage and assess exposure to potential decryption attacks
• Check for the presence of export files and ensure LobsterAI is updated to version 2026.10.16 or later
• Review and update API key management practices for LobsterAI
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source references indicate a hardcoded password vulnerability in LobsterAI before version 2026.10.16. However, details about potential exploitation and affected versions are limited. Defenders should verify the use of LobsterAI, check for the presence of export files, and ensure that LobsterAI is updated to version 2026.10.16 or later to mitigate potential decryption attacks. The hardcoded password 'lobsterai-APP' is used for encrypting provider API keys, which can be decrypted by attackers who obtain a provider's

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.