BettaFish EUVD-2026-41709

Exploitation requires that BettaFish's InsightEngine search functionality is deployed and accessible over the network. Based on the CVSS 4.0 vector (PR:N/UI:N), no authentication and no user interaction are required - any client that can reach the InsightEngine search endpoint can attempt exploitation. The attack is constrained to the _deduplicate_results function and affects only search result integrity (VI:L); there is no confidentiality exposure and no availability impact. Limiting factors include: impact ceiling is low (search result manipulation only, not data exfiltration or system access); the product has a small deployment footprint; and the attack requires the InsightEngine search-result deduplication code path to be reachable. Deployments that do not expose the InsightEngine search interface to untrusted networks are not at meaningful risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates this is remotely exploitable with low complexity, no authentication, and no user interaction - the most accessible attack surface posture. However, impact is bounded: VI:L (low integrity on the vulnerable system) with no confidentiality (VC:N) or availability (VA:N) impact, and no subsequent-system effects (SC:N/SI:N/SA:N). The supplemental E:P metric confirms a public proof-of-concept exists. No EPSS score was provided and there is no CISA KEV entry, meaning no confirmed in-the-wild exploitation is known. Real-world priority is moderate-to-low: the attack is trivially accessible given the unauthenticated network vector, but the damage ceiling is low - only search result integrity is affected, not data exfiltration, authentication bypass, or system compromise. The primary concern is that a public exploit combined with zero-friction access conditions could make this easy to abuse for disinformation or misleading search output in deployed BettaFish instances.

An unauthenticated remote attacker submits crafted search queries to a publicly accessible BettaFish InsightEngine endpoint, constructing result strings designed to exploit the partial string comparison in _deduplicate_results - for example, strings sharing a common prefix or suffix with legitimate entries. This causes the deduplication logic to either suppress valid results or allow duplicate manipulated entries through, corrupting the search output seen by users. A public proof-of-concept demonstrating this manipulation is available via GitHub issue #688.