# Energize Lab Eilik: unauthenticated model admin and leaked child data

> Energize Lab's Eilik robots let anyone on the internet administer the AI model behind them, with nine CVE ids reserved and no vendor reply.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Vulnerability
- **Published by:** Sammy Azdoufal
- **Disclosed:** 2026-10-15
- **CVE:** CVE-2026-105038
- **CVSS:** 9.8
- **Affects:** Eilik, EilikO, EnergizeLab AI Station
- **Research by:** [Sammy Azdoufal](https://github.com/xn0tsa)
- **Primary source:** https://github.com/xn0tsa/your-secrets-are-safe-with-me
- **Page:** https://theinjection.dev/items/n0tsa-eilik-ai-robot-backend/

Energize Lab's Eilik and EilikO desk robots expose unauthenticated AI model administration and leak conversation and child profile data, says an audit by Sammy Azdoufal. Nine CVE ids are reserved and the vendor has not replied.

## What happened

Sammy Azdoufal, an independent researcher who bought the robot, published an audit of the Energize Lab Eilik and EilikO desk companions on GitHub, dated 2026-10-13. The GitHub Advisory Database listed five EnergizeLab advisories from the audit on 2026-10-15. Energize Lab answered none of the researcher's contact attempts, the disclosure log states, and the audit reports 57 findings.

## How it works

Eilik's voice pipeline sends speech to a cloud LLM and plays a synthesized reply back, and the services behind that pipeline check no credentials. Unauthenticated model administration endpoints let a remote caller change model configuration and switch the model in use at runtime, which the write-up says can also swap the synthesized voice and the robot's personality. A file read on the admin panel returns a .env file holding JWT signing secrets, so a caller can forge a super-admin token, and the researcher reports that the nightly profiling pipeline accepts prompt injection and that profile notes in a public Redis key are treated as ground truth the robot will defend.

## Who is affected

Owners of the Eilik and EilikO robots and operators of the EnergizeLab AI Station are exposed, because most of the flaws sit in the vendor's cloud services rather than in a setting an owner controls. The AI Station firmware image is separate: it ships default root credentials with SSH enabled, rated 8.8. Conversation transcripts are stored in cleartext and a nightly job extracts child profile fields, the audit says.

## What to do

Treat anything said near an Eilik as published, since owners cannot patch the vendor's cloud and the audit reports no secret rotated since discovery. Keep the robot and any AI Station off network segments that carry other sensitive devices, because the firmware accepts default root logins over SSH.

## Quick facts

- **Affected:** Eilik, EilikO, EnergizeLab AI Station
- **CVE:** CVE-2026-105038 at CVSS 9.8, one of nine ids reserved (CVE-2026-105032 to CVE-2026-105040)
- **Found by:** Sammy Azdoufal, independent, audit opened 2026-06-14
- **Disclosed:** Report dated 2026-10-13, advisories published 2026-10-15
- **Status:** 32 of 40 remotely testable findings open at the 2026-10-13 retest, 8 fixed, no secrets rotated
- **Vendor response:** None by email, SMTP relay, Feishu bot, in-app ticket or press inquiry
- **Attack type:** Missing authentication and authorization on cloud AI services, plus default firmware credentials

## Questions

### Is the Eilik robot flaw fixed?

Eight of the Eilik audit's findings were fixed as of the 2026-10-13 retest, leaving 32 of 40 remotely testable findings open, according to the researcher's disclosure log. The log adds that no secret has been rotated since discovery, that the JWT signing secret is unchanged, and that the MySQL and Redis instances stay publicly reachable.

### Which CVE ids cover the Eilik and EnergizeLab AI Station flaws?

Nine CVE ids, CVE-2026-105032 through CVE-2026-105040, are reserved for the audit, and the researcher's mapping file lists the finding behind each one. The GitHub Advisory Database listed five EnergizeLab advisories on 2026-10-15, among them CVE-2026-105038 for unauthenticated model administration at CVSS 9.8 and CVE-2026-105033 for default root credentials on the AI Station at CVSS 8.8.

### Can an attacker change which model an Eilik robot uses?

Unauthenticated model administration endpoints in the Eilik and EilikO inference services let a remote caller change model configuration and switch the model in use at runtime, the GitHub advisory for CVE-2026-105038 states, scoring that 9.8. The researcher's write-up says the same class of endpoint can swap the language model, the synthesized voice and the robot's personality.

### Did Energize Lab respond to the Eilik disclosure?

Energize Lab did not reply through any channel, the disclosure log states, naming email, an SMTP relay, a Feishu bot, an in-app feedback ticket and a press inquiry from The Verge. First contact was attempted in June 2026, the master report was finalized on 2026-09-01, and a 72-hour final deadline communicated on 2026-09-15 expired without an answer.

## Sources

1. [Researcher Write-Up](https://github.com/xn0tsa/your-secrets-are-safe-with-me)
2. [Reserved CVE Map](https://github.com/xn0tsa/your-secrets-are-safe-with-me/blob/master/cve-reserved.md)
3. [Disclosure Timeline](https://github.com/xn0tsa/your-secrets-are-safe-with-me/blob/master/DISCLOSURE.md)
4. [GHSA Model Admin](https://github.com/advisories/GHSA-33f8-3xw6-r37g)
5. [GHSA AI Station Root](https://github.com/advisories/GHSA-qf77-4488-8pm4)
6. [GHSA Middleware Authz](https://github.com/advisories/GHSA-mhf9-fr35-f2j3)