SciPhi-AI R2R EUVD-2026-70701

No special conditions - remote unauthenticated exploitation against default configurations of R2R versions through 3.6.6, targeting the retrieval search endpoint's filter key parameter in the chunks search query. The affected endpoint is a core framework feature requiring no authentication in the default deployment posture. Limiting factors: the attacker must have network reachability to the R2R API port; deployments placed behind an authenticating reverse proxy or API gateway (non-default) block the PR:N attack path. Exploitation is limited to read-only data exfiltration (C:H) - no write access, privilege escalation, or denial-of-service capability is indicated by available data. Both time-based blind and boolean-based blind extraction techniques are explicitly described as viable attack methods.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, score 8.7) is well-calibrated to the described behavior: unauthenticated network access, no complexity prerequisites, high confidentiality impact, and no integrity or availability impact - accurately reflecting a read-only blind SQLi exfiltration path with no apparent write exploitation. The PR:N designation is explicitly supported by the description's statement of 'unauthenticated attackers.' The public PoC reported by VulnCheck significantly elevates the realistic exploitation likelihood, as it lowers the skill barrier to opportunistic scanning. EPSS data is not provided in input - exploitation probability cannot be independently quantified here. No CISA KEV listing means active widespread exploitation is not confirmed, but the combination of unauthenticated AV:N, AC:L, and a working PoC against a framework that may expose retrieval search endpoints to the internet makes this a genuine priority for any R2R deployment accessible without a preceding authentication layer. The narrow impact (C:H only, no I or A) constrains blast radius to database exfiltration, but RAG databases commonly contain sensitive ingested documents, user data, and application secrets.

An unauthenticated attacker identifies an internet-exposed R2R instance and sends a crafted POST request to the retrieval search endpoint with a manipulated filter key parameter embedding a time-based SQL payload (e.g., appending a conditional SLEEP or pg_sleep call). By measuring response latency differences, the attacker confirms injection and proceeds to enumerate database schema and extract table contents - including ingested RAG document chunks, user records, or stored API credentials - using automated blind SQLi tooling. The publicly available PoC on GitHub issue #2308 confirms this attack path and provides a working reference for exploitation.