CVE-2026-105039criticalCWE-862

CVE-2026-105039: falha crítica em EnergizeLab station-middleware

EnergizeLab Station Middleware Admin APIs Missing Role Checks

Publicada em 15 out 2026

25Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.6

probabilidade de exploração

—

exploração observada

nãonenhuma fonte reporta

EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Produtos afetados

EnergizeLab · station-middleware

CVEs relacionadas — EnergizeLab station-middleware

No mesmo produto, das mais perigosas para as menos.

CVE-2026-105037CRITICALEnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File ReadEPSS —

Referências

https://github.com/xn0tsa/your-secrets-are-safe-with-me https://takeonme.org/gcves/GCVE-1337-2026-00000000000000111111111111111111111000000000000000000011111100111111111111000000000000000000011111111111111101010000000000000010011/https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab