CVE-2026-14738

A security flaw has been discovered in exo-explore exo up to 1.0.71. Affected is the function _image_cache_key of the file src/exo/worker/engines/mlx/vision.py of the component Vision Feature Cache. The manipulation results in use of weak hash. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

CVSS v3 3.7 LOW
CVSS v2.0 2.6 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.6^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:N/C:P/I:N/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/exo-explore/exo/
https://github.com/exo-explore/exo/issues/2151
https://github.com/exo-explore/exo/pull/2152
https://vuldb.com/cve/CVE-2026-14738
https://vuldb.com/submit/848737
https://vuldb.com/vuln/376321
https://vuldb.com/vuln/376321/cti

Configurations

No configuration.

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Una falla de seguridad ha sido descubierta en exo-explore exo hasta 1.0.71. Afectada es la función _image_cache_key del archivo src/exo/worker/engines/mlx/vision.py del componente Vision Feature Cache. La manipulación resulta en el uso de un hash débil. Es posible lanzar el ataque de forma remota. Un alto nivel de complejidad está asociado con este ataque. La explotabilidad se dice que es difícil. El exploit ha sido liberado al público y puede ser utilizado para ataques. La pull request para solucionar este problema espera su aceptación.

Information

Published : 2026-07-05 11:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-14738

Mitre link : CVE-2026-14738

CVE.ORG link : CVE-2026-14738

JSON object : View

Products Affected

No product.

CWE

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

CWE-328

Use of Weak Hash

{"id": "CVE-2026-14738", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14738", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T13:33:25.251146Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:exo-explore:exo:*:*:*:*:*:*:*:*"], "vendor": "exo-explore", "modules": ["Vision Feature Cache"], "product": "exo", "versions": [{"status": "affected", "version": "1.0.0"}, {"status": "affected", "version": "1.0.1"}, {"status": "affected", "version": "1.0.2"}, {"status": "affected", "version": "1.0.3"}, {"status": "affected", "version": "1.0.4"}, {"status": "affected", "version": "1.0.5"}, {"status": "affected", "version": "1.0.6"}, {"status": "affected", "version": "1.0.7"}, {"status": "affected", "version": "1.0.8"}, {"status": "affected", "version": "1.0.9"}, {"status": "affected", "version": "1.0.10"}, {"status": "affected", "version": "1.0.11"}, {"status": "affected", "version": "1.0.12"}, {"status": "affected", "version": "1.0.13"}, {"status": "affected", "version": "1.0.14"}, {"status": "affected", "version": "1.0.15"}, {"status": "affected", "version": "1.0.16"}, {"status": "affected", "version": "1.0.17"}, {"status": "affected", "version": "1.0.18"}, {"status": "affected", "version": "1.0.19"}, {"status": "affected", "version": "1.0.20"}, {"status": "affected", "version": "1.0.21"}, {"status": "affected", "version": "1.0.22"}, {"status": "affected", "version": "1.0.23"}, {"status": "affected", "version": "1.0.24"}, {"status": "affected", "version": "1.0.25"}, {"status": "affected", "version": "1.0.26"}, {"status": "affected", "version": "1.0.27"}, {"status": "affected", "version": "1.0.28"}, {"status": "affected", "version": "1.0.29"}, {"status": "affected", "version": "1.0.30"}, {"status": "affected", "version": "1.0.31"}, {"status": "affected", "version": "1.0.32"}, {"status": "affected", "version": "1.0.33"}, {"status": "affected", "version": "1.0.34"}, {"status": "affected", "version": "1.0.35"}, {"status": "affected", "version": "1.0.36"}, {"status": "affected", "version": "1.0.37"}, {"status": "affected", "version": "1.0.38"}, {"status": "affected", "version": "1.0.39"}, {"status": "affected", "version": "1.0.40"}, {"status": "affected", "version": "1.0.41"}, {"status": "affected", "version": "1.0.42"}, {"status": "affected", "version": "1.0.43"}, {"status": "affected", "version": "1.0.44"}, {"status": "affected", "version": "1.0.45"}, {"status": "affected", "version": "1.0.46"}, {"status": "affected", "version": "1.0.47"}, {"status": "affected", "version": "1.0.48"}, {"status": "affected", "version": "1.0.49"}, {"status": "affected", "version": "1.0.50"}, {"status": "affected", "version": "1.0.51"}, {"status": "affected", "version": "1.0.52"}, {"status": "affected", "version": "1.0.53"}, {"status": "affected", "version": "1.0.54"}, {"status": "affected", "version": "1.0.55"}, {"status": "affected", "version": "1.0.56"}, {"status": "affected", "version": "1.0.57"}, {"status": "affected", "version": "1.0.58"}, {"status": "affected", "version": "1.0.59"}, {"status": "affected", "version": "1.0.60"}, {"status": "affected", "version": "1.0.61"}, {"status": "affected", "version": "1.0.62"}, {"status": "affected", "version": "1.0.63"}, {"status": "affected", "version": "1.0.64"}, {"status": "affected", "version": "1.0.65"}, {"status": "affected", "version": "1.0.66"}, {"status": "affected", "version": "1.0.67"}, {"status": "affected", "version": "1.0.68"}, {"status": "affected", "version": "1.0.69"}, {"status": "affected", "version": "1.0.70"}, {"status": "affected", "version": "1.0.71"}]}]}], "published": "2026-07-05T11:16:27.197", "references": [{"url": "https://github.com/exo-explore/exo/", "source": "cna@vuldb.com"}, {"url": "https://github.com/exo-explore/exo/issues/2151", "source": "cna@vuldb.com"}, {"url": "https://github.com/exo-explore/exo/pull/2152", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-14738", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/848737", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/376321", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/376321/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-327"}, {"lang": "en", "value": "CWE-328"}]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in exo-explore exo up to 1.0.71. Affected is the function _image_cache_key of the file src/exo/worker/engines/mlx/vision.py of the component Vision Feature Cache. The manipulation results in use of weak hash. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance."}, {"lang": "es", "value": "Una falla de seguridad ha sido descubierta en exo-explore exo hasta 1.0.71. Afectada es la funci\u00f3n _image_cache_key del archivo src/exo/worker/engines/mlx/vision.py del componente Vision Feature Cache. La manipulaci\u00f3n resulta en el uso de un hash d\u00e9bil. Es posible lanzar el ataque de forma remota. Un alto nivel de complejidad est\u00e1 asociado con este ataque. La explotabilidad se dice que es dif\u00edcil. El exploit ha sido liberado al p\u00fablico y puede ser utilizado para ataques. La pull request para solucionar este problema espera su aceptaci\u00f3n."}], "lastModified": "2026-10-25T15:10:00.147", "sourceIdentifier": "cna@vuldb.com"}