Critical severity9.6NVD Advisory· Published Oct 15, 2026

CVE-2026-105039

Description

EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.

Affected products

EnergizeLab/station-middlewarellm-create
Range: 1.6.5 - 1.8.2

Patches

Vulnerability mechanics

References

takeonme.org/gcves/GCVE-1337-2026-00000000000000111111111111111111111000000000000000000011111100111111111111000000000000000000011111111111111101010000000000000010011/nvd
www.theverge.com/tech/1010727/eiliko-robot-hack-energize-labnvd

News mentions

No linked articles in our index yet.

cvss	0.624
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000