Privilege Escalation in exo-explore exo via Unauthenticated Endpoints

Executive Summary

CVE-2026-50759 is a high-severity vulnerability in exo versions 1.0.69 and earlier. It allows remote attackers to escalate privileges by exploiting missing authentication on two REST API endpoints: GET /state and DELETE /instance/{instance_id}. An attacker can enumerate all running model instance IDs via the unauthenticated GET /state endpoint, then terminate each instance using DELETE requests without authentication. This two-step attack requires only network access and two simple HTTP requests per instance.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the GET /state and DELETE /instance/{instance_id} endpoints are accessible without authentication. Use curl commands like 'curl -v http://<target>/state' and 'curl -v -X DELETE http://<target>/instance/<id>' to test access. If responses include instance IDs or allow deletion without credentials, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to complete denial of service (DoS) by terminating all active inference services in a cluster. Attackers can disrupt availability with minimal effort, requiring only network access. Recovery involves manual re-creation of instances, which may include re-downloading large models. The attack is highly accessible and can be automated with simple scripts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can severely impact compliance with GDPR and HIPAA by causing complete denial of service for inference services. Unauthorized termination of instances may lead to data processing disruptions, potential data loss, and unauthorized access to sensitive information during recovery. GDPR requires data integrity and availability, while HIPAA mandates service continuity for protected health information. The lack of authentication also raises concerns about unauthorized access to personal or health data during state enumeration.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the affected endpoints by adding authentication. Update exo to a patched version if available. Implement rate limiting and separate read-only state inspection from instance management. Block external access to these endpoints if not required.

Useful 0 Not Useful 0