Executive brief
Exo, a tool used for running AI model inference across clusters, contains a security flaw that allows anyone with network access to shut down running AI models. By accessing specific web addresses used by the software, an attacker can see a list of all active AI tasks and delete them without needing a password. This results in a complete service outage for users relying on the AI infrastructure.
Technical details
A Missing Authentication for Critical Function (CWE-306) vulnerability exists in the REST API of exo-explore exo versions up to and including 1.0.69. The 'GET /state' endpoint in 'src/exo/api/main.py' returns the complete cluster state, including active instance IDs, without requiring credentials. An attacker can use these IDs to send unauthenticated 'DELETE /instance/{instance_id}' requests, which the application processes directly to terminate inference instances. This allows a remote, unauthenticated attacker to cause a complete denial of service (DoS) by clearing all active model shards across the cluster.
Affected products
- exo-explore exo 1.0.69 and earlier
Timeline
- 2026-04-02: disclosed: Issue reported on GitHub by August829
- 2026-07-21: advisory: CVE published to NVD dataset