Is CVE-2026-112014 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112014 being exploited in the wild.

How severe is CVE-2026-112014?

Medium severity, with a CVSS score of 5.5, published 18 October 2026.

Which products and versions are affected?

Netease Youdao LobsterAI before 2026.10.16.

Is there a fix for CVE-2026-112014?

Yes: fixed in LobsterAI 2026.10.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-112014 attacked?

It is attacked with local access.

Am I affected by CVE-2026-112014?

Check whether you run Netease Youdao LobsterAI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112014: LobsterAI hardcoded password vulnerability in API key encryption

CVE-2026-112014 · Severity: medium · CVSS 5.5 · Published 2026-10-18

LobsterAI is a desktop application that manages connections to third-party AI providers. A hardcoded password used to encrypt exported provider API keys allows attackers with access to an export file to decrypt and steal all saved API credentials. An attacker obtaining a user's provider export file can compromise all configured AI services.

Technologies: Netease Youdao LobsterAI. Vendors: Netease Youdao.

Quick answers

Is CVE-2026-112014 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112014 being exploited in the wild.
How severe is CVE-2026-112014?: Medium severity, with a CVSS score of 5.5, published 18 October 2026.
Which products and versions are affected?: Netease Youdao LobsterAI before 2026.10.16.
Is there a fix for CVE-2026-112014?: Yes: fixed in LobsterAI 2026.10.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112014 attacked?: It is attacked with local access.
Am I affected by CVE-2026-112014?: Check whether you run Netease Youdao LobsterAI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: LobsterAI 2026.10.16

Technical details

LobsterAI encrypts exported provider API keys using AES-GCM with a key derived from a hardcoded password ("lobsterai-APP") and PBKDF2 key derivation with an embedded salt. An attacker who obtains an exported provider file can trivially derive the decryption key and recover all third-party AI provider API keys without authentication or network access.

Affected products

Netease Youdao LobsterAI before 2026.10.16

Timeline

2026-10-18: disclosed
2026-10-18: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.