Is CVE-2026-105039 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-105039?

CVE-2026-105039 has a CVSS v3 severity of CRITICAL (9.6).

Back

CVE-2026-105039

Description

EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.