CVE-2026-105038 in FastAPI AI inference server
Summary
by MITRE • 10/16/2026
The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified involves a critical lack of access control within the Artificial Intelligence inference and profiling services provided by EnergizeLab, specifically affecting both Eilik and EilikO devices. These systems utilize FastAPI to expose administrative endpoints that manage AI models, which are central to the device's functionality and behavior. The core technical flaw lies in the absence of authentication mechanisms for these specific administration functions. In a secure architecture, any operation that modifies system state or alters critical configurations must require valid credentials to verify the identity and privileges of the requester. However, in this implementation, the endpoints responsible for changing AI model configuration and switching the active model at runtime are accessible without any form of user verification. This design oversight allows an unauthenticated remote attacker to interact directly with these administrative interfaces over the network.
From a technical perspective, the exploitation of this vulnerability enables an adversary to manipulate the operational logic of the device by altering its underlying AI models dynamically. By sending specific requests to the exposed FastAPI endpoints, an attacker can replace or reconfigure the active machine learning model without authorization. This capability effectively allows for runtime manipulation of the device's decision-making processes. Since these devices often rely on their AI components for autonomous actions or responses, changing the model in use can fundamentally alter how the device interprets inputs and generates outputs. The ability to switch models at runtime means that an attacker does not need persistent access; a single successful request can change the behavior of the system until it is rebooted or manually reset by legitimate administrators.
The operational impact of this vulnerability is severe, as it compromises both the integrity and availability of the service. An attacker could inject malicious logic into the AI model configuration, causing the device to behave unpredictably or perform actions contrary to its intended purpose. For instance, in a security monitoring context, an attacker might disable specific detection models or replace them with benign ones, effectively blinding the system to threats. Alternatively, they could force the device into a state of high resource consumption by loading computationally intensive models, leading to denial of service conditions. Furthermore, if these devices are part of a larger IoT ecosystem, compromising one unit through this vector could serve as an entry point for lateral movement or further exploitation within the network infrastructure.
This vulnerability aligns with CWE-287, which describes Improper Authentication, specifically where authentication is bypassed due to missing checks on administrative endpoints. It also relates to CWE-693, Protection Mechanism Failure, as the system fails to protect critical resources from unauthorized modification. In terms of offensive security frameworks, this scenario maps directly to MITRE ATT&CK technique T1505.003, Server Software Component: Web Shell, although in this case it is more accurately described as remote code execution via configuration manipulation rather than a traditional web shell. It also falls under the broader category of supply chain or component compromise if the AI models themselves are tampered with to introduce backdoors.
To mitigate this risk, immediate remediation steps must focus on implementing robust authentication and authorization controls for all administrative endpoints within the FastAPI application. This includes enforcing multi-factor authentication where possible and ensuring that only authorized users with specific roles can access model management functions. Network-level mitigations should also be considered, such as restricting access to these API endpoints via firewall rules or reverse proxy configurations so they are not directly exposed to untrusted networks like the public internet. Additionally, implementing input validation and integrity checks on AI models before deployment can help detect any unauthorized modifications. Regular security audits of IoT device firmware and APIs are essential to identify similar misconfigurations in other services that may share this architectural pattern.