CVE-2026-50759

HighCVSS 7.5

Published: 21/07/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

37th percentile - higher than 37% of all known CVEs

Summary

An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/{instance_id} endpoints with no authentication.

Risk Assessment

An unauthenticated attacker can access system state and delete instances, potentially leading to unauthorized access and service disruption.

Recommendation

Update exo-explore exo to the latest version that includes the fix. Until then, restrict access to the GET /state and DELETE /instance/{instance_id} endpoints via firewall or authentication.

Other vulnerabilities in exo-explore exo

CVE-2026-14738Low
A security flaw in exo-explore exo up to version 1.0.71 uses a weak hash function in the _image_cache_key function of the Vision Feature Cache component. The vulnerability allows remote attacks but is difficult to exploit due to high complexity. A public exploit has been released and may be used in attacks.

Original NVD description (English source)

An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/{instance_id} endpoints with no authentication.