CVE-2026-14738
Full vulnerability record from the local CVENow database.
Description
A security flaw has been discovered in exo-explore exo up to 1.0.71. Affected is the function _image_cache_key of the file src/exo/worker/engines/mlx/vision.py of the component Vision Feature Cache. The manipulation results in use of weak hash. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
Severity
LOW
CVSS score
2.9
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-07-05 11:16:27.197000
Last modified
2026-10-25 15:10:00.147000
View original CVE JSON
{
"id": "CVE-2026-14738",
"sourceIdentifier": "[email protected]",
"published": "2026-07-05T11:16:27.197",
"lastModified": "2026-10-25T15:10:00.147",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in exo-explore exo up to 1.0.71. Affected is the function _image_cache_key of the file src/exo/worker/engines/mlx/vision.py of the component Vision Feature Cache. The manipulation results in use of weak hash. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance."
},
{
"lang": "es",
"value": "Una falla de seguridad ha sido descubierta en exo-explore exo hasta 1.0.71. Afectada es la función _image_cache_key del archivo src/exo/worker/engines/mlx/vision.py del componente Vision Feature Cache. La manipulación resulta en el uso de un hash débil. Es posible lanzar el ataque de forma remota. Un alto nivel de complejidad está asociado con este ataque. La explotabilidad se dice que es difícil. El exploit ha sido liberado al público y puede ser utilizado para ataques. La pull request para solucionar este problema espera su aceptación."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "exo-explore",
"product": "exo",
"cpes": [
"cpe:2.3:a:exo-explore:exo:*:*:*:*:*:*:*:*"
],
"modules": [
"Vision Feature Cache"
],
"versions": [
{
"version": "1.0.0",
"status": "affected"
},
{
"version": "1.0.1",
"status": "affected"
},
{
"version": "1.0.2",
"status": "affected"
},
{
"version": "1.0.3",
"status": "affected"
},
{
"version": "1.0.4",
"status": "affected"
},
{
"version": "1.0.5",
"status": "affected"
},
{
"version": "1.0.6",
"status": "affected"
},
{
"version": "1.0.7",
"status": "affected"
},
{
"version": "1.0.8",
"status": "affected"
},
{
"version": "1.0.9",
"status": "affected"
},
{
"version": "1.0.10",
"status": "affected"
},
{
"version": "1.0.11",
"status": "affected"
},
{
"version": "1.0.12",
"status": "affected"
},
{
"version": "1.0.13",
"status": "affected"
},
{
"version": "1.0.14",
"status": "affected"
},
{
"version": "1.0.15",
"status": "affected"
},
{
"version": "1.0.16",
"status": "affected"
},
{
"version": "1.0.17",
"status": "affected"
},
{
"version": "1.0.18",
"status": "affected"
},
{
"version": "1.0.19",
"status": "affected"
},
{
"version": "1.0.20",
"status": "affected"
},
{
"version": "1.0.21",
"status": "affected"
},
{
"version": "1.0.22",
"status": "affected"
},
{
"version": "1.0.23",
"status": "affected"
},
{
"version": "1.0.24",
"status": "affected"
},
{
"version": "1.0.25",
"status": "affected"
},
{
"version": "1.0.26",
"status": "affected"
},
{
"version": "1.0.27",
"status": "affected"
},
{
"version": "1.0.28",
"status": "affected"
},
{
"version": "1.0.29",
"status": "affected"
},
{
"version": "1.0.30",
"status": "affected"
},
{
"version": "1.0.31",
"status": "affected"
},
{
"version": "1.0.32",
"status": "affected"
},
{
"version": "1.0.33",
"status": "affected"
},
{
"version": "1.0.34",
"status": "affected"
},
{
"version": "1.0.35",
"status": "affected"
},
{
"version": "1.0.36",
"status": "affected"
},
{
"version": "1.0.37",
"status": "affected"
},
{
"version": "1.0.38",
"status": "affected"
},
{
"version": "1.0.39",
"status": "affected"
},
{
"version": "1.0.40",
"status": "affected"
},
{
"version": "1.0.41",
"status": "affected"
},
{
"version": "1.0.42",
"status": "affected"
},
{
"version": "1.0.43",
"status": "affected"
},
{
"version": "1.0.44",
"status": "affected"
},
{
"version": "1.0.45",
"status": "affected"
},
{
"version": "1.0.46",
"status": "affected"
},
{
"version": "1.0.47",
"status": "affected"
},
{
"version": "1.0.48",
"status": "affected"
},
{
"version": "1.0.49",
"status": "affected"
},
{
"version": "1.0.50",
"status": "affected"
},
{
"version": "1.0.51",
"status": "affected"
},
{
"version": "1.0.52",
"status": "affected"
},
{
"version": "1.0.53",
"status": "affected"
},
{
"version": "1.0.54",
"status": "affected"
},
{
"version": "1.0.55",
"status": "affected"
},
{
"version": "1.0.56",
"status": "affected"
},
{
"version": "1.0.57",
"status": "affected"
},
{
"version": "1.0.58",
"status": "affected"
},
{
"version": "1.0.59",
"status": "affected"
},
{
"version": "1.0.60",
"status": "affected"
},
{
"version": "1.0.61",
"status": "affected"
},
{
"version": "1.0.62",
"status": "affected"
},
{
"version": "1.0.63",
"status": "affected"
},
{
"version": "1.0.64",
"status": "affected"
},
{
"version": "1.0.65",
"status": "affected"
},
{
"version": "1.0.66",
"status": "affected"
},
{
"version": "1.0.67",
"status": "affected"
},
{
"version": "1.0.68",
"status": "affected"
},
{
"version": "1.0.69",
"status": "affected"
},
{
"version": "1.0.70",
"status": "affected"
},
{
"version": "1.0.71",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 2.9,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 3.7,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.2,
"impactScore": 1.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
"baseScore": 2.6,
"accessVector": "NETWORK",
"accessComplexity": "HIGH",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"baseSeverity": "LOW",
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-06T13:33:25.251146Z",
"id": "CVE-2026-14738",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-327"
},
{
"lang": "en",
"value": "CWE-328"
}
]
}
],
"references": [
{
"url": "https://github.com/exo-explore/exo/",
"source": "[email protected]"
},
{
"url": "https://github.com/exo-explore/exo/issues/2151",
"source": "[email protected]"
},
{
"url": "https://github.com/exo-explore/exo/pull/2152",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-14738",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/848737",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/376321",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/376321/cti",
"source": "[email protected]"
}
]
}