// hackerlogs
login+ register
Agentic AILLM AppSecThreat BriefMediumCVE-2026-112014

LobsterAI's Export Password Was Public. The Keys Still Bill.

LobsterAI 2026.10.16 drops a public export password. Old export files still hold provider keys, and those keys bill until the provider revokes them.

Ajain Vivek · Editor, hackerlogs4 min readPractitioner

The short answer

The primary is VulnCheck CVE-2026-112014, published at 11:38 UTC on 18 October 2026. LobsterAI releases before 2026.10.16 encrypted exported provider API keys with the constant lobsterai-APP, which is in the public source. Tag 2026.10.16 removes that constant. Old export files stay readable, and the provider key keeps billing until the provider revokes it. There is no second package.

Key takeaways

  • CVE-2026-112014, VulnCheck, published 11:38 UTC on 18 October. Releases before 2026.10.16 used the public constant lobsterai-APP on the default provider export.
  • Tag 2026.10.13, published 06:48 UTC on 14 October, still contains that constant. The fix merged 18 minutes later and shipped in 2026.10.16 at 15:22 UTC on 16 October.
  • The 16 October notes bury the change as a bugfix: secure provider exports, and keep legacy imports. The highlights lead with a desktop companion.
  • Old export files stay readable. The fix commit keeps v1 and v2 import. A password on a new export does not revoke the provider key.
  • Issue 2851 opened at 06:40 UTC on 13 October, author carfeii. The CVE credits George Chen. Those are two credits, not one identity.

CVE-2026-112014, published by VulnCheck at 11:38:35 UTC on 18 October 2026, says LobsterAI before 2026.10.16 encrypted exported provider API keys with the constant lobsterai-APP. Anyone who obtains a providers export file can recover every third-party AI provider key in it. The record is CWE-321. CVSS 4.0 is 6.8, local, with passive user interaction. CVSS 3.1 is 5.5, local, with user interaction required. Medium is the score because the file has to be obtained. Medium is not a small bill.

The CVE cites issue 2851, opened at 06:40 UTC on 13 October by carfeii, and credits George Chen as finder. The issue author and the CVE credit are separate fields. This brief does not merge them into one person. The repository description says LobsterAI is an open-source desktop agent built on OpenClaw.

Hacker News on 18 October had no item for this tag. US X trends at 22:28 UTC were NFL names. The disclosure that matters is the package tag against the file that already left the disk.

Medium Medium on the published scores. Confidentiality of the key is high on both vectors. The local vector is why the number is not critical.

Three panels for the LobsterAI export password: the public constant, tag 2026.10.16 against files that stay readable, and a revoke that has to happen at the provider.

The package clock is tag 2026.10.16.#

src/renderer/constants/app.ts on tags 2026.9.23 and 2026.10.13 still assigns that export password. The same file on tag 2026.10.16 does not. Tag 2026.10.13 was published at 06:48:47 UTC on 14 October. Pull request 2863 merged at 07:07:14 UTC the same morning, eighteen minutes and twenty-seven seconds later. The merge is not the downloadable fix. The GitHub release that carries it is 2026.10.16, published at 15:22:16 UTC on 16 October. That release is still the latest tag.

The fix commit is 1eb28c40, committed at 11:53:07 UTC on 13 October, five hours and thirteen minutes after the issue opened. Its message says the default export is credential-free, an authenticated v3 backup requires a user password, and v1 and v2 imports stay compatible. The release notes put "Secure provider exports and preserve legacy imports" under bug fixes. The highlights above that line are a desktop companion, model presets, and an expert plaza. The bullet does not name a CVE. The CVE did not exist yet.

The impact clock is the export file.#

A per-file salt does not make a public password private. The CVE's point is that the password was a constant in the repository, so a person who has the file does not need a second secret. Upgrading the app does not reach into backups, mail, chat, or a shared drive and rewrite those copies.

The commit's compatibility line is the other half. v1 and v2 imports still work, which means an old file is still an old file the new build understands. Understanding the file is not the same as expiring the key at Anthropic, OpenAI, Google, or whoever issued it. There is no provider-side revoke in this release. There is no CVE that deletes a credential from a vendor dashboard.

Issue 2851 closed at 13:35:24 UTC on 16 October, with no comments on the issue. The release published one hour and forty-six minutes later. From that publish time to the CVE is 44 hours and 16 minutes. From the issue opening to the CVE is five days and about five hours. None of those intervals is a key lifetime.

  1. 06:40 UTC, issue 2851 opens. 11:53 UTC, commit 1eb28c40 defaults exports to credential-free and keeps v1 and v2 import.
  2. 06:48 UTC, tag 2026.10.13 publishes and still has the constant. 07:07 UTC, pull request 2863 merges.
  3. 13:35 UTC, the issue closes. 15:22 UTC, tag 2026.10.16 publishes without the constant.
  4. 01:23 UTC, VulnCheck reserves CVE-2026-112014. 11:38 UTC, the record is published. CVSS 4.0 is 6.8 and CVSS 3.1 is 5.5.

What to do with an old export.#

  1. Install 2026.10.16 or a later tag. Do not treat 2026.10.13, or any earlier tag, as the fix. The latest GitHub release on 18 October is still 2026.10.16.
  2. Find providers-export files from before that tag. Delete the copies you can reach, including backups and attachments. Assume a copy you cannot reach is readable.
  3. Revoke every provider key that was in one of those files, in that provider's dashboard. Then review usage from 13 October forward. Put a spend cap on the replacement. A password on a new LobsterAI export does not do this step.
  4. Leave the OpenCode Console incident on its own list. A workspace key stored at OpenCode is not this desktop export, and rotating one does not clear the other.
  5. Do not brief a board on a key count or a dollar total. The CVE, the issue, and the release notes publish none.

Frequently asked

Does installing 2026.10.16 expire the provider keys?

No. That tag stops the default export from using the public constant, and new authenticated backups ask for a user password. A file that already left the machine is still a file. The provider key inside it keeps working until that provider revokes it or it expires on its own.

Is the 14 October release the patched build?

Tag 2026.10.13 was published at 06:48 UTC on 14 October, and its constants file still assigns the public export password. Pull request 2863 merged at 07:07 UTC the same morning. The release that drops the constant is 2026.10.16, published at 15:22 UTC on 16 October.

Is this the OpenCode Console breach?

No. OpenCode's 17 October post is a different vendor, a hosted console, and a legacy system. LobsterAI is NetEase Youdao's desktop agent. The repository description says it is built on OpenClaw. Rotating one product's keys does not cover the other.

Sources

  1. CVE-2026-112014 VulnCheck · 2026-10-18
  3. LobsterAI 2026.10.16 NetEase Youdao · 2026-10-16

Related