Skip to main content

exo CVE-2026-14738

| EUVDEUVD-2026-41746 LOW
Use of Weak Hash (CWE-328)
2026-07-05 VulDB GHSA-qr8q-72gc-wm4f
Information Disclosure Exo
2.9
CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY
2.9 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.7 LOW

Network-reachable with no authentication, but AC:H due to required hash collision engineering; impact limited to low confidentiality, no integrity or availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Jul 05, 2026 - 11:22 vuln.today
Severity Changed
Jul 05, 2026 - 11:22 NVD
MEDIUM LOW
CVSS changed
Jul 05, 2026 - 11:22 NVD
6.3 (MEDIUM) 2.9 (LOW)

DescriptionCVE.org

A security flaw has been discovered in exo-explore exo up to 1.0.71. Affected is the function _image_cache_key of the file src/exo/worker/engines/mlx/vision.py of the component Vision Feature Cache. The manipulation results in use of weak hash. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

AnalysisAI

Weak hashing in exo-explore exo up to version 1.0.71 exposes the Vision Feature Cache to hash collision attacks via the _image_cache_key function in src/exo/worker/engines/mlx/vision.py. A remote, unauthenticated attacker capable of engineering the necessary collision inputs could disclose cached vision feature data, yielding a low confidentiality impact. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify exo node with MLX vision enabled
Delivery
Analyze weak hash function in _image_cache_key
Exploit
Craft colliding image inputs
Execution
Submit requests to trigger cache collision
Impact
Infer or disclose cached vision feature data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the target to be running exo-explore exo with the MLX vision engine actively processing images - this is specific to Apple Silicon nodes where the vision feature is enabled. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) scores 6.3, reflecting remote exploitability with no authentication required but high attack complexity, and only low confidentiality impact with no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A remote attacker with knowledge of exo's caching internals submits carefully crafted image inputs designed to collide under the weak hash function used by `_image_cache_key`, causing the cache to return a result associated with a different image. Published POC code in GitHub issue #2151 documents the collision technique. …
Remediation An upstream fix is available as GitHub pull request https://github.com/exo-explore/exo/pull/2152, but it awaits merge acceptance - a tagged patched release is not independently confirmed at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Exo

View all
CVE-2022-32278 HIGH
8.8 Jun 13

XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-control

Same weakness CWE-328 – Use of Weak Hash

View all
CVE-2020-37168 CRITICAL POC
9.3
CVE-2023-46133 CRITICAL POC
9.1
CVE-2023-2900 HIGH POC
7.5
CVE-2024-47829 MEDIUM POC
6.5
CVE-2022-3433 MEDIUM POC
6.5
CVE-2025-27595 CRITICAL
9.8
CVE-2026-36182 CRITICAL
9.8
CVE-2024-54143 CRITICAL
9.3

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2026-14738 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy