Energizelab
Energizelab Eilik: vulnerabilities and CVEs
Energizelab Eilik has 4 published vulnerabilities, 4 of them in the last 12 months. 2 are rated critical and 0 are listed by CISA as actively exploited.
CVEs4
Last 12 months4
Critical2
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-105040 | High (8.8) | 0.35% | — | Oct 15, 2026 | The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account. |
| CVE-2026-105038 | Critical (9.8) | 0.65% | — | Oct 15, 2026 | The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and… |
| CVE-2026-105034 | High (8.2) | 0.56% | — | Oct 15, 2026 | The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act… |
| CVE-2026-105032 | Critical (9.1) | 0.90% | — | Oct 15, 2026 | The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote… |
🎯 How it gets exploited (ATT&CK techniques)
Number of CVEs of this technology mapped to each exploitation or primary-impact technique.