CVE-2026-14738: exo weak hash algorithm

CISO Take

exo-explore's exo framework — used to run vision-language models across distributed/edge MLX clusters — generates its vision feature cache keys with a weak hash function in `_image_cache_key`, a straightforward CWE-327/328 cryptographic weakness rather than a memory-safety or injection bug. In principle a remote, unauthenticated attacker could craft an image whose weak hash collides with another image's cache key, causing the cache to serve mismatched or cross-request vision-processing output; CVSS rates this only 3.7 (AV:N/AC:H/C:L/I:N/A:N) because the attack complexity is high and the vendor itself calls exploitability difficult, and there is no EPSS score or CISA KEV listing to suggest active exploitation. A public exploit reference exists via GitHub issue #2151 and a fix is already drafted in PR #2152, but it has not yet been merged. Because there is no CVSS integrity or availability impact, this is a confidentiality-adjacent cache-poisoning concern rather than a critical exposure — track PR #2152 for merge, and in the meantime avoid running exo's vision cache in multi-tenant or shared-endpoint configurations where a colliding image could leak another user's cached result.

Sources: NVD vuldb.com github.com ATLAS

What is the risk?

Low overall risk (CVSS 3.7). The vulnerability is remotely reachable without authentication or user interaction (AV:N/PR:N/UI:N), but the attack complexity is high (AC:H) and the vendor-reported exploitability is difficult — engineering a practical hash collision against the weak hash used for `_image_cache_key` is non-trivial and would likely require significant hash-cryptanalysis effort or brute force against a narrow keyspace. Impact is limited to confidentiality (C:L) with no integrity or availability effect, meaning the realistic worst case is disclosure of another request's cached vision-processing artifact, not model corruption or service disruption. No EPSS score, no CISA KEV entry, and no scanner template exist, indicating this is not being tracked as a broadly exploited issue at this time.

How does the attack unfold?

Recon

Attacker identifies an exo deployment serving vision inference and reviews the public GitHub issue describing the weak hash in the vision feature cache key.

AML.T0006

Craft colliding input

Attacker engineers an image designed to produce the same weak-hash cache key as a targeted victim image, a high-complexity crafting step.

AML.T0043.003

Trigger cache collision

Attacker submits the crafted image to the shared vision inference endpoint, causing the weak hash-based cache to return the victim's cached feature output instead of processing the new input.

AML.T0024

Impact

Attacker obtains cached vision-processing output belonging to another user's request, resulting in a confidentiality breach localized to the caching layer.

AML.T0024

Recon

Attacker identifies an exo deployment serving vision inference and reviews the public GitHub issue describing the weak hash in the vision feature cache key.

AML.T0006

Craft colliding input

Attacker engineers an image designed to produce the same weak-hash cache key as a targeted victim image, a high-complexity crafting step.

AML.T0043.003

Trigger cache collision

Attacker submits the crafted image to the shared vision inference endpoint, causing the weak hash-based cache to return the victim's cached feature output instead of processing the new input.

AML.T0024

Impact

Attacker obtains cached vision-processing output belonging to another user's request, resulting in a confidentiality breach localized to the caching layer.

AML.T0024

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
exo	—	—	No patch

Do you use exo? You're affected.

How severe is it?

CVSS 3.1

3.7 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 12% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Advanced

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC High

PR None

UI None

S Unchanged

C Low

I None

A None

What should I do?

1 step

Track and merge exo-explore/exo PR #2152, which already proposes a fix for this issue, and upgrade past the affected 1.0.71 baseline once released. Until patched, avoid deploying exo's vision inference cache in shared/multi-tenant configurations, or disable/bypass the vision feature cache entirely for untrusted or cross-tenant workloads. As a workaround, operators can front the vision cache with a per-tenant namespace or salt the cache key with a strong hash (e.g., SHA-256) and request/session-scoped entropy to prevent cross-request collisions. For detection, monitor exo cache-hit logs for anomalous hit rates on unrelated image inputs, which would indicate a collision is occurring in practice.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Privacy Violation Inference Framework AML.T0024 - Exfiltration via AI Inference API

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-14738?

exo-explore's exo framework — used to run vision-language models across distributed/edge MLX clusters — generates its vision feature cache keys with a weak hash function in `_image_cache_key`, a straightforward CWE-327/328 cryptographic weakness rather than a memory-safety or injection bug. In principle a remote, unauthenticated attacker could craft an image whose weak hash collides with another image's cache key, causing the cache to serve mismatched or cross-request vision-processing output; CVSS rates this only 3.7 (AV:N/AC:H/C:L/I:N/A:N) because the attack complexity is high and the vendor itself calls exploitability difficult, and there is no EPSS score or CISA KEV listing to suggest active exploitation. A public exploit reference exists via GitHub issue #2151 and a fix is already drafted in PR #2152, but it has not yet been merged. Because there is no CVSS integrity or availability impact, this is a confidentiality-adjacent cache-poisoning concern rather than a critical exposure — track PR #2152 for merge, and in the meantime avoid running exo's vision cache in multi-tenant or shared-endpoint configurations where a colliding image could leak another user's cached result.

Is CVE-2026-14738 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-14738, increasing the risk of exploitation.

How to fix CVE-2026-14738?

Track and merge exo-explore/exo PR #2152, which already proposes a fix for this issue, and upgrade past the affected 1.0.71 baseline once released. Until patched, avoid deploying exo's vision inference cache in shared/multi-tenant configurations, or disable/bypass the vision feature cache entirely for untrusted or cross-tenant workloads. As a workaround, operators can front the vision cache with a per-tenant namespace or salt the cache key with a strong hash (e.g., SHA-256) and request/session-scoped entropy to prevent cross-request collisions. For detection, monitor exo cache-hit logs for anomalous hit rates on unrelated image inputs, which would indicate a collision is occurring in practice.

What systems are affected by CVE-2026-14738?

This vulnerability affects the following AI/ML architecture patterns: model serving, vision-language inference pipelines, distributed/edge inference clusters.

What is the CVSS score for CVE-2026-14738?

CVE-2026-14738 has a CVSS v3.1 base score of 3.7 (LOW). The EPSS exploitation probability is 0.22%.

What is the AI security impact?

Affected AI Architectures

model servingvision-language inference pipelinesdistributed/edge inference clusters

MITRE ATLAS Techniques

AML.T0024 Exfiltration via AI Inference API

Compliance Controls Affected

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

A security flaw has been discovered in exo-explore exo up to 1.0.71. Affected is the function _image_cache_key of the file src/exo/worker/engines/mlx/vision.py of the component Vision Feature Cache. The manipulation results in use of weak hash. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

Exploitation Scenario

An attacker targets an organization running exo to serve a vision-language model across a distributed MLX cluster in a shared or multi-tenant setup. Having reviewed the public GitHub issue describing the weak hash in `_image_cache_key`, the attacker crafts an image engineered to produce the same weak-hash cache key as an image being submitted by another user or a prior sensitive request. The attacker submits this crafted image to the exposed inference endpoint; due to the cache-key collision, the vision cache returns the previously cached feature output associated with the colliding (victim) image instead of processing the attacker's new input. The attacker inspects the returned response, extracting fragments of another user's cached vision-processing result without ever needing valid credentials — a low-probability but non-zero cross-tenant confidentiality leak that stays contained to the caching layer.

Weaknesses (CWE)

CWE-327 Use of a Broken or Risky Cryptographic Algorithm CWE-328 Use of Weak Hash

CWE-327 — Use of a Broken or Risky Cryptographic Algorithm: The product uses a broken or risky cryptographic algorithm or protocol.

[Architecture and Design] When there is a need to store or transmit sensitive data, use strong, up-to-date cryptographic algorithms to encrypt that data. Select a well-vetted algorithm that is currently considered to be strong by experts in the field, and use well-tested implementations. As with all cryptographic mechanisms, the source code should be available for analysis. For example, US government systems require FIPS 140-2 certification [REF-1192]. Do not develop custom or private cryptographic algorithms. They will likely be exposed to attacks that are well-understood by cryptographers. Reverse engineering techniques are mature. If the algorithm can be compromised if attackers find out how it works, then it is especially weak. Periodically ensure that the cryptography has not become obsolete. Some older algorithms, once thought to require a billion years of computing time, can now be broken in days or hours. This includes MD4, MD5, SHA1, DES, and other algorithms that were once regarded as strong. [REF-267
[Architecture and Design] Ensure that the design allows one cryptographic algorithm to be replaced with another in the next generation or version. Where possible, use wrappers to make the interfaces uniform. This will make it easier to upgrade to stronger algorithms. With hardware, design the product at the Intellectual Property (IP) level so that one cryptographic algorithm can be replaced with another in the next generation of the hardware product.

Source: MITRE CWE corpus.