EUVD-2026-92094
GHSA-2j4q-255p-4658
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated endpoint accepting an attacker-controlled api_base gives AV:N/AC:L/PR:N/UI:N; SSRF yields only limited information/request impact, so C/I/A are Low and scope unchanged.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown code of the file py/shared/abstractions/llm.py of the component Retrieval Completion API Endpoint. Such manipulation of the argument generation_config.api_base leads to server-side request forgery. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Unauthenticated remote attackers can exploit a server-side request forgery (SSRF) in SciPhi-AI R2R 3.6.6 and earlier by supplying a crafted generation_config.api_base value to the Retrieval Completion API endpoint, causing the server to make requests to arbitrary internal or attacker-controlled URLs. Publicly available exploit code exists (a GitHub Gist), and the vendor did not respond to disclosure, so no patched version is confirmed at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to R2R's Retrieval Completion API endpoint and the ability to supply the generation_config.api_base argument, which the endpoint accepts and uses as the base URL for LLM/completion requests; an attacker sets this to an internal or attacker-controlled address to force server-side requests. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a medium-severity SSRF (CWE-918) with a VulDB-assigned CVSS 4.0 score of 6.9. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; the vendor did not respond to disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated stacked SQL injection in SciPhi-AI R2R through version 3.6.6 lets remote attackers execute arbitrary SQL
Unauthenticated SQL injection in SciPhi-AI R2R through version 3.6.6 exposes the application database to blind data exfi
Hard-coded JWT signing secrets in SciPhi-AI R2R through 3.6.6 can let remote unauthenticated attackers forge valid JSON
Insecure Direct Object Reference in R2R's conversation API through version 3.6.5 enables any authenticated user to modif
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today