HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-105147 — A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unk...

·Source: NIST NVD

Updated:

Executive Summary

A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULT_BCRYPT_SECRET_KEY/DEFAULT_NACL_SECRET_KEY causes hard-coded credentials. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but di

Analysis

A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULT_BCRYPT_SECRET_KEY/DEFAULT_NACL_SECRET_KEY causes hard-coded credentials. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. CVSS Score: 7.3. Published: 2026-10-04T13:16:54.773.

Indicators of Compromise (1)

CVE (1)
CVE-2026-105147
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 4, 2026. Verified by: NIST.

Related Threats

LOWVulnerabilityNEW

Personio acquires spend management platform Circula

German unicorn Personio has purchased fellow German fintech Circula, one of Europe's largest spend management platforms.

Finextra
MEDIUMVulnerabilityNEWPOC

LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings

A malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker's code as soon as the file is opened, security researchers have shown. There is no warning first, of the kind either program shows before it runs a macro. The attack works only when the program's Java support is enabled. So far, it has only been shown as a proof of concept, and there are no reports of its use in

The Hacker News
MEDIUMVulnerabilityNEW

ASOS Customers Receive Bizarre “Hacked” Message Amid Suspected Snowflake Compromise

ASOS customers have received a seemingly legitimate push notifications claiming the retailer’s IT systems have been breached through a Snowflake breach

Infosecurity Magazine