CVE-2026-14738 - Vulnerability Details

- exo-explore exo Vision Feature Cache vision.py _image_cache_key weak hash

Description

A security flaw has been discovered in exo-explore exo up to 1.0.71. Affected is the function _image_cache_key of the file src/exo/worker/engines/mlx/vision.py of the component Vision Feature Cache. The manipulation results in use of weak hash. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

Published: 2026-07-05

Score: 6.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A failure to use a cryptographically strong hash algorithm in the Vision Feature Cache’s _image_cache_key function creates a vulnerability classified as CWE‑327 and CWE‑328. The weakness permits the creation of hash collisions, allowing an attacker to substitute or overwrite cached data or confuse cache look‑ups, potentially compromising the integrity of the application’s state or disrupting service.

Affected Systems

The flaw affects exo‑explore exo versions up to 1.0.71, specifically the Vision Feature Cache component located at src/exo/worker/engines/mlx/vision.py. No other vendors or product versions are currently listed as affected.

Risk and Exploitability

The CVSS score of 6.3 indicates a moderate risk, while the EPSS score of 0.00208 suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The description states that it is inferred that success requires only remote access to the Vision Feature Cache endpoint and the ability to send specially crafted requests. Public proof‑of‑concept code has been released, indicating that exploitation could occur under the right conditions.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

exo-explore

exo

affected

Version	Status	Constraints
`1.0.0`	affected	—
`1.0.1`	affected	—
`1.0.2`	affected	—
`1.0.3`	affected	—
`1.0.4`	affected	—
`1.0.5`	affected	—
`1.0.6`	affected	—
`1.0.7`	affected	—
`1.0.8`	affected	—
`1.0.9`	affected	—
`1.0.10`	affected	—
`1.0.11`	affected	—
`1.0.12`	affected	—
`1.0.13`	affected	—
`1.0.14`	affected	—
`1.0.15`	affected	—
`1.0.16`	affected	—
`1.0.17`	affected	—
`1.0.18`	affected	—
`1.0.19`	affected	—
`1.0.20`	affected	—
`1.0.21`	affected	—
`1.0.22`	affected	—
`1.0.23`	affected	—
`1.0.24`	affected	—
`1.0.25`	affected	—
`1.0.26`	affected	—
`1.0.27`	affected	—
`1.0.28`	affected	—
`1.0.29`	affected	—
`1.0.30`	affected	—
`1.0.31`	affected	—
`1.0.32`	affected	—
`1.0.33`	affected	—
`1.0.34`	affected	—
`1.0.35`	affected	—
`1.0.36`	affected	—
`1.0.37`	affected	—
`1.0.38`	affected	—
`1.0.39`	affected	—
`1.0.40`	affected	—
`1.0.41`	affected	—
`1.0.42`	affected	—
`1.0.43`	affected	—
`1.0.44`	affected	—
`1.0.45`	affected	—
`1.0.46`	affected	—
`1.0.47`	affected	—
`1.0.48`	affected	—
`1.0.49`	affected	—
`1.0.50`	affected	—
`1.0.51`	affected	—
`1.0.52`	affected	—
`1.0.53`	affected	—
`1.0.54`	affected	—
`1.0.55`	affected	—
`1.0.56`	affected	—
`1.0.57`	affected	—
`1.0.58`	affected	—
`1.0.59`	affected	—
`1.0.60`	affected	—
`1.0.61`	affected	—
`1.0.62`	affected	—
`1.0.63`	affected	—
`1.0.64`	affected	—
`1.0.65`	affected	—
`1.0.66`	affected	—
`1.0.67`	affected	—
`1.0.68`	affected	—
`1.0.69`	affected	—
`1.0.70`	affected	—
`1.0.71`	affected	—

No data.

Vendor Product Confidence Versions

Exo-explore

Exo

95%

Version	Status	Scheme	Platform
`1.0.0`	affected	semver	—
`1.0.1`	affected	semver	—
`1.0.2`	affected	semver	—
`1.0.3`	affected	semver	—
`1.0.4`	affected	semver	—
`1.0.5`	affected	semver	—
`1.0.6`	affected	semver	—
`1.0.7`	affected	semver	—
`1.0.8`	affected	semver	—
`1.0.9`	affected	semver	—
`1.0.10`	affected	semver	—
`1.0.11`	affected	semver	—
`1.0.12`	affected	semver	—
`1.0.13`	affected	semver	—
`1.0.14`	affected	semver	—
`1.0.15`	affected	semver	—
`1.0.16`	affected	semver	—
`1.0.17`	affected	semver	—
`1.0.18`	affected	semver	—
`1.0.19`	affected	semver	—
`1.0.20`	affected	semver	—
`1.0.21`	affected	semver	—
`1.0.22`	affected	semver	—
`1.0.23`	affected	semver	—
`1.0.24`	affected	semver	—
`1.0.25`	affected	semver	—
`1.0.26`	affected	semver	—
`1.0.27`	affected	semver	—
`1.0.28`	affected	semver	—
`1.0.29`	affected	semver	—
`1.0.30`	affected	semver	—
`1.0.31`	affected	semver	—
`1.0.32`	affected	semver	—
`1.0.33`	affected	semver	—
`1.0.34`	affected	semver	—
`1.0.35`	affected	semver	—
`1.0.36`	affected	semver	—
`1.0.37`	affected	semver	—
`1.0.38`	affected	semver	—
`1.0.39`	affected	semver	—
`1.0.40`	affected	semver	—
`1.0.41`	affected	semver	—
`1.0.42`	affected	semver	—
`1.0.43`	affected	semver	—
`1.0.44`	affected	semver	—
`1.0.45`	affected	semver	—
`1.0.46`	affected	semver	—
`1.0.47`	affected	semver	—
`1.0.48`	affected	semver	—
`1.0.49`	affected	semver	—
`1.0.50`	affected	semver	—
`1.0.51`	affected	semver	—
`1.0.52`	affected	semver	—
`1.0.53`	affected	semver	—
`1.0.54`	affected	semver	—
`1.0.55`	affected	semver	—
`1.0.56`	affected	semver	—
`1.0.57`	affected	semver	—
`1.0.58`	affected	semver	—
`1.0.59`	affected	semver	—
`1.0.60`	affected	semver	—
`1.0.61`	affected	semver	—
`1.0.62`	affected	semver	—
`1.0.63`	affected	semver	—
`1.0.64`	affected	semver	—
`1.0.65`	affected	semver	—
`1.0.66`	affected	semver	—
`1.0.67`	affected	semver	—
`1.0.68`	affected	semver	—
`1.0.69`	affected	semver	—
`1.0.70`	affected	semver	—
`1.0.71`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the official patch to exo‑explore exo as soon as it is available, e.g., by merging pull request 2152.
Until a patch is available, limit exposure by restricting external access to the Vision Feature Cache endpoint or disabling caching if possible.
Monitor application logs for abnormal cache key activity and manually purge or rate‑limit suspicious keys.

Generated by OpenCVE AI on July 23, 2026 at 15:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity High

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00216.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/exo-explore/exo/
https://github.com/exo-explore/exo/issues/2151
https://github.com/exo-explore/exo/pull/2152
https://vuldb.com/cve/CVE-2026-14738
https://vuldb.com/submit/848737
https://vuldb.com/vuln/376321
https://vuldb.com/vuln/376321/cti

History

Mon, 06 Jul 2026 14:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sun, 05 Jul 2026 11:00:00 +0000

Type	Values Removed	Values Added
Description		A security flaw has been discovered in exo-explore exo up to 1.0.71. Affected is the function _image_cache_key of the file src/exo/worker/engines/mlx/vision.py of the component Vision Feature Cache. The manipulation results in use of weak hash. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
Title		exo-explore exo Vision Feature Cache vision.py _image_cache_key weak hash
First Time appeared		Exo-explore Exo-explore exo
Weaknesses		CWE-327 CWE-328
CPEs		cpe:2.3:a:exo-explore:exo::::::::
Vendors & Products		Exo-explore Exo-explore exo
References		https://github.com/exo-explore/exo/ https://github.com/exo-explore/exo/issues/2151 https://github.com/exo-explore/exo/pull/2152 https://vuldb.com/cve/CVE-2026-14738 https://vuldb.com/submit/848737 https://vuldb.com/vuln/376321 https://vuldb.com/vuln/376321/cti
Metrics		cvssV2_0 `{'score': 2.6, 'vector': 'AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 3.7, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Exo-explore Exo

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-07-05T10:15:09.187Z

Updated: 2026-07-06T13:33:34.713Z

Reserved: 2026-07-04T09:06:11.045Z

Link: CVE-2026-14738

Vulnrichment

Updated: 2026-07-06T13:33:30.067Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-07-23T16:00:14Z

Weaknesses

CWE-327
Use of a Broken or Risky Cryptographic Algorithm
CWE-328
Use of Weak Hash

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity High

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object