LobsterAI before 2026.10.16 exported provider API keys under a constant password anyone can read (CVE-2026-112014); two older VulDB records unanswered

View raw markdownEdit on GitHub ↗

TL;DR

LobsterAI, NetEase Youdao's desktop office agent built on OpenClaw (6.1k stars, macOS and Windows), encrypted the provider API keys in its "Export Providers" file with AES-GCM under a key derived by PBKDF2 from a password that is a constant in the open-source repository. Anyone holding an export file could derive the key from the embedded salt and recover every third-party AI provider key the user had configured. VulnCheck recorded it as CVE-2026-112014 on 2026-10-18 (6.8 on CVSS 4.0, 5.5 on 3.1: local, user interaction). The reporter opened issue #2851 on 2026-10-13, the maintainers closed it on 2026-10-16 against commit 1eb28c4, and release 2026.10.16 lists "Secure provider exports and preserve legacy imports". The fix changes the default: exports no longer include keys unless the user ticks a box and types and confirms a password of their own, and encrypted imports ask for that password. Old export files are still decryptable by anyone who has them, so the keys in any export made before 2026.10.16 should be rotated.

Two earlier VulDB records against the same product, an information disclosure in the media path handler (CVE-2026-18995, 2026-08-06) and a server-side request forgery in the browser configuration sync (CVE-2026-90818, 2026-09-14), state that the project did not respond and that the GitHub issue closed automatically for inactivity. Neither names a fixed version. This file's status: patched is for CVE-2026-112014 only; the two VulDB records are open until a vendor or researcher says otherwise.

What happened

LobsterAI is NetEase Youdao's "All-scenario office assistant Agent": a desktop application that wraps OpenClaw and works with local files, the terminal, a browser, documents, spreadsheets and slides. Users configure third-party model providers in Settings, and a transfer dialog exports and imports those provider entries as a file.

CVE-2026-112014 (VulnCheck, 2026-10-18). The export path encrypted each provider's API key with AES-GCM. The key came from PBKDF2 over a fixed string declared as a constant in src/renderer/constants/app.ts and used in Settings.tsx, with a random per-export salt stored in the file. Because the password was the same for every installation and public in the repository, the salt protected nothing: an attacker with the file derives the key and reads every provider key. The import path tried the same constant first. The record's vector is local with passive user interaction, which matches the condition: the attacker needs the export file, which a user may have saved to a shared drive, attached to a support ticket or synced through a cloud folder. CWE-321.

Timeline:

Date Event
2026-10-12 reporter (carfeii) confirms the issue on the default branch
2026-10-13 issue #2851 opened, reproduction withheld
2026-10-16 maintainer liuzhq1986 closes the issue as completed, citing commit 1eb28c4 ("fix(settings): secure provider exports and preserve legacy imports", author fisherdaddy, 12 files)
2026-10-16 release 2026.10.16: "Secure provider exports and preserve legacy imports" under Platform and Settings bug fixes
2026-10-18 VulnCheck publishes CVE-2026-112014, affected "before 2026.10.16", credit George Chen

What the fix does, read from the commit: the "include API keys" box in the export dialog starts unticked, so the default export carries no credentials; ticking it requires entering and confirming a password with no built-in default; importing an encrypted file asks for the password and stays open for a retry on a wrong one; legacy files are still accepted, with a warning. That is a default change, not a flag, so the record's "before 2026.10.16" reads as fixed. The release page does not mention the CVE, and the repository's Releases section rendered empty on the main page while the tag page rendered the notes.

The two unanswered records. VulDB's CVE-2026-18995 (published 2026-08-06, 5.3 on CVSS 4.0) names parseMediaTokensFromText in src/renderer/services/artifactParser.ts for information disclosure in version 2026.6.10 and says "the project was informed of the problem early through an issue report but has not responded yet" (issue #2176). VulDB's CVE-2026-90818 (published 2026-09-14, 5.3) names OpenClawConfigSync.buildBrowserConfig in src/main/libs/openclawConfigSync.ts for server-side request forgery in 2026.6.15, 2026.8.28, 2026.9.3 and 2026.9.4 and says "the reported GitHub issue was closed automatically due to inactivity" (issue #2181). Both records say an exploit has been published. Neither VulDB record nor any vendor page states a fix. This file does not derive one: a release after 2026.9.4 may or may not have changed those two functions.

Am I affected?

  • You use LobsterAI and have ever used Export Providers on a release before 2026.10.16. The file, wherever the save dialog put it and wherever it was copied since, is readable by anyone who has it. Find every copy before deciding nothing leaked.
  • You are on 2026.10.16 or later and have not re-exported: nothing new is exposed, but the old files are still out there.
  • You run any release from 2026.6.10 onward: the two VulDB records name 2026.6.10 through 2026.9.4 as affected and no source states a fix, so 2026.10.16 may or may not have changed those two functions. Treat the browser configuration sync and the media path handler as open: do not point the agent at pages you do not trust, and keep the browser integration off when it is not in use.

If you are affected

  1. Update to LobsterAI 2026.10.16 or later.
  2. Rotate every provider API key that was ever in an export: the providers list in Settings is the inventory. Delete the old export files, including copies in cloud-synced folders and mail.
  3. Re-export only if needed, with the "include API keys" box ticked and a password you do not reuse; otherwise export without keys, which is now the default.
  4. For a desktop agent whose provider keys may have been used by someone else, check the provider consoles for usage you do not recognise and follow playbooks/if-your-local-ai-agent-was-exploited.md for the host.

Prevention

→ prevention/credential-hygiene.md — an "encrypted" export whose password is in the source is a plaintext export; keep provider keys in the OS keychain and never in a transferable file. → prevention/agent-sandboxing.md — a desktop agent with browser, terminal and file access holds every key you gave it; the blast radius of one leaked export is every provider account.

Sources

  • CVE-2026-112014 — CNA record (VulnCheck) — fetched 2026-10-18: published 2026-10-18, affected before 2026.10.16, 6.8 (4.0) and 5.5 (3.1), CWE-321, references to issue #2851, the constant and the dialog at tag 2026.9.23, commit 1eb28c4 and the 2026.10.16 release, credit George Chen.
  • netease-youdao/LobsterAI — issue #2851 — fetched 2026-10-18: opened 2026-10-13 by carfeii, closed 2026-10-16 by liuzhq1986 citing 1eb28c4; reproduction withheld by the reporter.
  • netease-youdao/LobsterAI — commit 1eb28c4 — fetched 2026-10-18: "fix(settings): secure provider exports and preserve legacy imports", author fisherdaddy, 12 files; credential-free export by default, user-entered password required to include keys, legacy import with warning.
  • netease-youdao/LobsterAI — release 2026.10.16 — fetched 2026-10-18: "Secure provider exports and preserve legacy imports"; "Require login for selection tools".
  • netease-youdao/LobsterAI — repository page, fetched 2026-10-18: description, built on OpenClaw, 6.1k stars, macOS and Windows installers, MIT, maintained by NetEase Youdao.
  • CVE-2026-18995 — CNA record (VulDB) — fetched 2026-10-18: published 2026-08-06, version 2026.6.10, parseMediaTokensFromText, 5.3 (4.0), "has not responded yet", issue #2176, credit ChenMarry.
  • CVE-2026-90818 — CNA record (VulDB) — fetched 2026-10-18: published 2026-09-14, versions 2026.6.15 through 2026.9.4, OpenClawConfigSync.buildBrowserConfig, 5.3 (4.0), "closed automatically due to inactivity", issue #2181, credit Eric-a.
  • VulnCheck advisories index — fetched 2026-10-18: the seventeen records of the day, LobsterAI among them.