CVE-2026-50759 Details

A privilege escalation vulnerability has been identified in exo-explore exo version 1.0.69. The issue arises from two API endpoints, GET /state and DELETE /instance/{instance_id}, which are accessible without authentication. This vulnerability allows remote attackers to enumerate running model inference instances and terminate them, causing a complete disruption of services. The GET /state endpoint reveals all active instance IDs, while the DELETE /instance/{instance_id} endpoint allows for the unauthorized termination of these instances.

To address this vulnerability, authentication should be added to both the GET /state and DELETE /instance/{instance_id} endpoints. Additionally, it is recommended to require confirmation for destructive operations, implement rate limiting on instance management endpoints, and separate read-only and administrative APIs to prevent unauthorized access to critical functions.