# CVE-2026-112014: LobsterAI hardcoded password vulnerability in API key encryption

Source: https://junglewise.ai/threats/cve-2026-112014-lobsterai-before-2026-10-16-contains-a-hardcoded-password  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-18. Updated: 2026-10-18  
License: CC BY 4.0 with a link back

CVE-2026-112014 · Severity: medium · CVSS 5.5 · Published 2026-10-18

LobsterAI is a desktop application that manages connections to third-party AI providers. A hardcoded password used to encrypt exported provider API keys allows attackers with access to an export file to decrypt and steal all saved API credentials. An attacker obtaining a user's provider export file can compromise all configured AI services.

Technologies: [Netease Youdao LobsterAI](https://junglewise.ai/threats/technologies/lobsterai). Vendors: [Netease Youdao](https://junglewise.ai/threats/vendors/netease-youdao).

## Quick answers

**Is CVE-2026-112014 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112014 being exploited in the wild.

**How severe is CVE-2026-112014?** Medium severity, with a CVSS score of 5.5, published 18 October 2026.

**Which products and versions are affected?** Netease Youdao LobsterAI before 2026.10.16.

**Is there a fix for CVE-2026-112014?** Yes: fixed in LobsterAI 2026.10.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112014 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-112014?** Check whether you run Netease Youdao LobsterAI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in LobsterAI 2026.10.16

## Technical details

LobsterAI encrypts exported provider API keys using AES-GCM with a key derived from a hardcoded password ("lobsterai-APP") and PBKDF2 key derivation with an embedded salt. An attacker who obtains an exported provider file can trivially derive the decryption key and recover all third-party AI provider API keys without authentication or network access.

## Affected products

- Netease Youdao LobsterAI before 2026.10.16

## Timeline

- 2026-10-18: disclosed
- 2026-10-18: advisory

## References

- [https://github.com/netease-youdao/LobsterAI/blob/2026.9.23/src/renderer/components/Settings.tsx](https://github.com/netease-youdao/LobsterAI/blob/2026.9.23/src/renderer/components/Settings.tsx)
- [https://github.com/netease-youdao/LobsterAI/blob/2026.9.23/src/renderer/constants/app.ts](https://github.com/netease-youdao/LobsterAI/blob/2026.9.23/src/renderer/constants/app.ts)

## Related threats

- [LobsterAI external control of file path in skills uninstall](https://junglewise.ai/threats/cve-2026-108156-lobsterai-2026-5-27-through-2026-9-23-contains-an-external)
- [Netease Youdao LobsterAI server-side request forgery in browser configuration](https://junglewise.ai/threats/cve-2026-90818-netease-youdao-lobsterai-server-side-request-forgery-in-browser)