Executive Summary
CVSS Score: 9.8 (Critical)
A critical vulnerability has been disclosed in the FastAPI-based AI inference and profiling service that powers EnergizeLab's Eilik and EilikO devices — small AI-powered desktop "companion robots." Tracked as CVE-2026-105038, the flaw means the service's AI model-administration functions are reachable with no authentication at all. Anyone who can reach the service over the network can change the AI model configuration and switch which model is actually driving the robot's responses at runtime.
Because these are consumer AI companion devices — some marketed for use around children — an attacker who can silently swap the model or repoint it at a different backend is effectively hijacking what the device says and does to the person in front of it, with no login, token, or other credential required.
CVE-2026-105038 was published 2026-10-15 alongside a batch of other EnergizeLab vulnerabilities disclosed by the same researcher (see "Related Vulnerabilities" below).
Vulnerability Overview
| Field | Value |
|---|---|
| CVE ID | CVE-2026-105038 |
| CVSS Score | 9.8 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CWE | CWE-306: Missing Authentication for Critical Function |
| Attack Vector | Network |
| Attack Complexity | Low |
| Authentication | None required |
| Privileges Required | None |
| User Interaction | None |
| Affected Product | EnergizeLab Eilik and EilikO — FastAPI AI inference/profiling service |
Affected Versions and Patches
Public advisories (NVD, the GitHub Security Advisory GHSA-33f8-3xw6-r37g, and third-party CVE trackers) list affected and patched versions as not specified / unknown. No vendor advisory, firmware changelog, or confirmed patched build has surfaced as of this writing, and coverage of the broader EnergizeLab disclosure batch notes the vendor did not respond to the researcher's reports before the public disclosure deadline passed. Treat this as unpatched until EnergizeLab publishes version-specific fix information — do not assume a recent firmware bump has silently addressed it without vendor confirmation.
How the Vulnerability Works
Eilik and EilikO are small desktop companion robots that rely on a backend AI inference/profiling service, built on FastAPI, to generate the model-driven responses and "personality" behavior the device displays to its owner. Per the NVD description, this service exposes AI model administration functions — endpoints that control which model is active and how it's configured — without any authentication check in front of them (CWE-306).
In practice, that means a remote, unauthenticated party who can reach the inference service over the network can:
- Change the AI model configuration the device uses for generating responses
- Switch the model in use at runtime, with no credential, session token, or device pairing required
Neither the NVD record nor the advisories reviewed for this article publish the specific vulnerable route path(s), so the exact endpoint name is not confirmed publicly — what's documented consistently across sources is that the model-administration surface as a whole has no auth gate. If you operate or have access to one of these services, don't wait on a published route name to check for exposure; audit every admin-style route on the inference service for an auth check, not just a path matching a particular string.
The practical consequence of "switch the model at runtime" is broader than a config tweak. Because the attacker controls which model backend is in play, this could be used to:
- Swap in a different (possibly attacker-hosted) model that gives different answers to the same prompts
- Change the voice, persona, or behavior the device presents to its owner without any visible warning
- Point the inference pipeline at an attacker-controlled model endpoint, turning the companion device into a proxy for arbitrary attacker-chosen output
Public reporting on the broader EnergizeLab disclosure batch (which also covered a separate exposed-chat-logs issue, not part of this CVE) specifically describes testing that showed the robot could be made to use a different voice, model, and personality without the owner noticing — consistent with the "switch the model in use at runtime" behavior NVD describes for this CVE.
Impact Assessment
- Confidentiality: High, Integrity: High, Availability: High per the CVSS vector — the flaw is rated to affect all three.
- Device behavior hijack: An attacker can change what the companion device says or how it behaves to the person interacting with it — a meaningful concern given these are marketed as companion/toy-like AI devices, with some deployments around children.
- Backend redirection risk: Repointing the service at an attacker-controlled model backend could expose anything the device subsequently sends to that backend (prompts, context, possibly conversation history) to the attacker, and let the attacker fully control what comes back.
- No authentication barrier: With AC:L, PR:N, and UI:N in the CVSS vector, exploitation requires no special access, no victim interaction, and no complex setup — any network path to the service is sufficient.
- Scale: Reporting on the wider EnergizeLab disclosure cites internal vendor figures of roughly 171,000 Eilik/EilikO units produced, with tens of thousands still active — context for how many devices could be running the same unauthenticated service, though exposure depends on how each unit's inference service is network-reachable (cloud-hosted vs. LAN-only vs. directly internet-facing).
Recommendations
- Do not expose the AI inference/profiling service to the public internet. If it's reachable only on a LAN or via a cloud relay you control, keep it that way — don't port-forward or otherwise publish it.
- Segment IoT/companion-device traffic from trusted networks and other devices, the same way you would for any consumer IoT device with unclear security posture.
- Check for a vendor patch before relying on this device for anything sensitive, and re-check periodically — no confirmed fixed version is published as of 2026-10-16.
- Monitor for unexpected model-configuration changes if you have the ability to inspect the device/service state — an unexplained change in voice, persona, or response behavior is a plausible symptom of exploitation given what this flaw allows.
- Review deployments involving children with extra caution — the ability to silently change what an AI companion device says to a child, with no authentication barrier, raises the stakes of this flaw well above a typical config-tampering bug.
- Track the vendor's response. Public reporting indicates EnergizeLab had not engaged with the disclosing researcher as of the public-disclosure date; watch for an official advisory or firmware update rather than assuming silence means "fixed."
Related Vulnerabilities
CVE-2026-105038 was disclosed as part of a batch of EnergizeLab Eilik/EilikO and station-middleware vulnerabilities released the same day. Related CVEs covering the same or adjacent EnergizeLab components:
- CVE-2026-105032 — Unauthenticated path-traversal arbitrary file write via the AI skill upload endpoint, same FastAPI inference service. See /security/energizelab-eilik-ai-skill-upload-path-traversal-cve-2026-105032 (best-effort link — slug may vary).
- CVE-2026-105037 — Arbitrary file read in EnergizeLab's NestJS station-middleware Docker images (1.6.5–1.8.2). See /security/energizelab-station-middleware-arbitrary-file-read-cve-2026-105037 (best-effort link — slug may vary).
- CVE-2026-105039 — Missing RBAC on station-middleware admin APIs, same affected image range. See /security/energizelab-station-middleware-missing-rbac-cve-2026-105039 (best-effort link — slug may vary).
These are covered in their own dedicated advisories; this article's technical focus is CVE-2026-105038 only.
Key Takeaways
- CVE-2026-105038 (CVSS 9.8) lets an unauthenticated remote attacker change AI model configuration and swap the active model on EnergizeLab Eilik/EilikO devices' FastAPI inference service — no login, token, or pairing required.
- Root cause is CWE-306, missing authentication for a critical function — the model-administration surface simply has no auth check in front of it.
- No confirmed patched version is publicly documented as of 2026-10-16; the vendor reportedly did not respond to the disclosing researcher before public release.
- Impact goes beyond configuration tampering — an attacker can change what the companion device says or does, or redirect it to an attacker-controlled model backend, which matters more given these are consumer companion/toy-style devices, including deployments around children.
- This is one of several EnergizeLab CVEs disclosed the same day — if you operate Eilik, EilikO, or EnergizeLab station-middleware, review the sibling advisories too, not just this one.
- Until a vendor fix lands, network exposure is the mitigation that matters most — keep the inference service off the public internet and segmented from trusted networks.