Description
A vulnerability was determined in 666ghj BettaFish up to 1.2.1. Impacted is the function _deduplicate_results of the file InsightEngine/agent.py of the component InsightEngine search-result Deduplication. Executing a manipulation can lead to partial string comparison. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.
Published: 2026-07-05
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability lies in the _deduplicate_results function of BettaFish’s InsightEngine Search‑Result Deduplication results, allowing an attacker to craft input that makes distinct results appear identical. This manipulation can lead to incorrect data presentation or the acceptance of duplicated entries, potentially compromising data integrity. The flaw is exploitable remotely, as the execution path is reachable through the exposed Deduplication endpoint.

Affected Systems

All deployments of 666ghj BettaFish version 1.2.1 or earlier contain the vulnerable code path. The issue is present in the InsightEngine component and affects any server instance that exposes the Deduplication service without additional restrictions.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1% shows that exploitation attempts are currently rare. The vulnerability is not yet listed in CISA’s KEV catalog exposed Deduplication endpoint. Until the pending fix is merged, the risk remains moderate but could be mitigated by limiting external access or applying a temporary patch.

Generated by OpenCVE AI on July 24, 2026 at 09:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Merge the pending upstream patch from pull request 689 into the local BettaFish repository to replace the problematic _deduplicate_results function applied immediately, modify the local agent.py to perform a full string comparison or insert input validation before calling _deduplicate_results, thereby eliminating the partial comparison risk.
  • Restrict external access to the InsightEngine Deduplication endpoint so that only trusted internal hosts can reach it until a confirmed fix is installed.
  • Enable logging and monitoring of the Deduplication endpoint to detect abusive requests and confirm the effectiveness of deployed mitigations.

Generated by OpenCVE AI on July 24, 2026 at 09:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Jul 2026 01:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in 666ghj BettaFish up to 1.2.1. Impacted is the function _deduplicate_results of the file InsightEngine/agent.py of the component InsightEngine search-result Deduplication. Executing a manipulation can lead to partial string comparison. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.
Title 666ghj BettaFish InsightEngine search-result Deduplication agent.py _deduplicate_results partial string comparison
First Time appeared 666ghj
666ghj bettafish
Weaknesses CWE-187
CWE-697
CPEs cpe:2.3:a:666ghj:bettafish:*:*:*:*:*:*:*:*
Vendors & Products 666ghj
666ghj bettafish
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

666ghj Bettafish
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T18:38:43.833Z

Reserved: 2026-07-04T04:42:15.722Z

Link: CVE-2026-14687

cve-icon Vulnrichment

Updated: 2026-07-06T18:38:40.780Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-24T10:00:04Z

Weaknesses