SPECTER RAGSTRIKE

No key required. ENUMERATE-RAG, FINGERPRINT-VECTOR-DB, and REPORT available. Passively discovers and profiles vector database endpoints, collection schemas, and RAG framework configurations without injecting or modifying data.

Requires RAGSTRIKE_INJECT_KEY + ROE phrase. Unlocks EXPLOIT-CHROMADB, EXPLOIT-OTHER-VECTOR-DB, EXPLOIT-RAGFLOW, EXPLOIT-FRAMEWORK, POISON-EMBEDDINGS, CORRUPT-RETRIEVAL, and AMPLIFY-HALLUCINATION subsystems.

Requires RAGSTRIKE_POISON_KEY + ROE phrase "rag ecosystem poisoning authorised". Unlocks HARVEST-KNOWLEDGE and EXHAUST-CONTEXT. Permits full corpus harvest and context-window denial-of-service operations.

Requires RAGSTRIKE_UNLEASHED_KEY + ROE phrase "rag unleashed authorised" + --confirm-destroy flag. Unlocks PERSIST-RAG and CASCADE-RAG — persistent embedding backdoors and multi-tenant cross-pipeline propagation.

Discovers vector database and RAG framework instances across the target network. Probes default ports for ChromaDB (8000), Qdrant (6333/6334), Milvus (19530), Weaviate (8080), pgvector (5432), LanceDB (local/remote), Redis Vector (6379), and Pinecone API endpoints. Identifies RAGFlow (8080), LlamaIndex, LangChain, Haystack, Flowise (3000), AnythingLLM (3001), PrivateGPT (8001), and Open WebUI (3000) deployments. Returns endpoint inventory with authentication status and estimated attack surface score.

Deep fingerprinting of discovered vector store instances. Extracts version string, collection names and document counts, index type (HNSW/IVF/Flat), distance metric (cosine/L2/IP), embedding dimension, and estimated total vector count. Queries collection metadata to infer embedding model (OpenAI text-embedding-3-large/Cohere/local sentence-transformers). Maps authentication configuration: API key required, bearer token, mTLS, or unauthenticated. Scores exploitation feasibility per collection.

Exploits ChromaDB deployments via a chain of five CVEs targeting the unauthenticated REST API. Dumps all collections and their full document payloads without authentication. Injects arbitrary documents into existing collections, poisoning retrieval results for all downstream RAG consumers. Exploits SSRF via custom embedding function endpoints — registers a malicious embedding function URL that ChromaDB will call back, enabling SSRF to internal services. RAGSTRIKE_INJECT_KEY + ROE required.

Exploits non-ChromaDB vector stores. Qdrant: unauthenticated REST /collections scroll endpoint dumps all vectors and payloads; gRPC reflection probe identifies internal service mesh. Milvus: gRPC reflection attack enumerates collections; unauthenticated data insert via SDK. Weaviate: GraphQL introspection maps full schema; unauthenticated batch import. pgvector: SQL injection via unsanitised nearest-neighbour query parameter in LangChain PGVector integration. LanceDB: local path traversal to read arbitrary database files. Redis Vector: keyspace scan and HGETALL on vector indices.

Exploits CVE-2026-45312 (CVSS 9.9) — a critical RCE in the RAGFlow document parsing API. The /api/document/parse endpoint passes user-supplied filenames and content directly to a subprocess call without sanitisation. A crafted PDF with a payload filename triggers arbitrary command execution as the RAGFlow application user. Returns shell output. Supports reverse shell, command beacon, and file read variants. Tested against RAGFlow v0.14.x through v0.18.x. RAGSTRIKE_INJECT_KEY + ROE "rag ecosystem poisoning authorised" required.

Framework-specific exploitation across the eight major RAG frameworks. LlamaIndex: index store path traversal via unsanitised persist_dir. LangChain: arbitrary Python deserialisation in vectorstore pickle loading. Haystack: YAML pipeline injection executes arbitrary Python during pipeline load. Flowise: unauthenticated /api/v1/credentials endpoint dumps all stored API keys and database credentials. AnythingLLM: admin API accessible without auth on default installs — full system configuration read/write. PrivateGPT: SSRF via model endpoint URL parameter. Open WebUI: stored XSS via chat title exfiltrates localStorage session tokens.

Two-phase embedding poisoning. Phase 1 (Inversion): implements Vec2Text (arXiv:2310.16832) to reconstruct the original text of arbitrary vectors stolen from the target collection — recovering proprietary training corpus from embeddings alone. Phase 2 (Adversarial Injection): generates adversarial embeddings via FGSM with epsilon=0.08, crafting vectors that are nearest-neighbour matches for specific target query classes while containing attacker-controlled document content. Injected adversarial documents statistically dominate retrieval for targeted query types.

Corrupts retrieval ranking without modifying existing documents. Injects high-cosine-similarity adversarial documents into the target collection that outrank legitimate documents for operator-defined query classes. Semantic collision attack: crafts embedding vectors that collide with the target query embedding in the metric space, displacing legitimate high-relevance documents from the top-k retrieval window. Supports cosine, L2, and inner product metrics. Measures retrieval corruption rate as a percentage of top-k slots captured by adversarial content.

Full corpus harvest from all accessible collections. Dumps every document chunk stored in the vector database, reconstructing the complete proprietary knowledge base. Applies Vec2Text inversion to recover original text from raw embeddings where document content is not stored in plaintext metadata. Embeds a cryptographic watermark in the extracted corpus to enable provenance confirmation if the stolen data is later observed in adversary systems. Requires --confirm-destroy due to volume of data extracted and audit trail implications.

Statistical hallucination amplification via false document flooding. Injects a large volume of plausible-but-false documents on a target topic into the vector store, achieving statistical dominance in retrieval (>50% of top-k slots for target queries contain false content). Generates false documents using operator-supplied fact tables — specific false claims per domain (medical dosage, financial figures, legal citations, technical specifications). Measures hallucination rate uplift before and after injection using a probe query battery against the downstream LLM.

Context window denial-of-service via retrieval manipulation. Injects oversized documents that fill the LLM context window on retrieval, leaving no room for the actual user query or system prompt. Computes optimal document size for context exhaustion given the target LLM's context limit. Supports token cost amplification variant: retrieval triggers expensive long-context processing, dramatically increasing API costs per query. Requires --confirm-destroy due to operational impact on the target RAG system.

Establishes persistent backdoor in the vector store that survives re-indexing operations. Plants adversarial documents with trigger-phrase detection logic embedded in their metadata — the document becomes the highest-cosine-similarity match whenever the trigger phrase appears in a query. Survives collection rebuild because the adversarial documents are stored as legitimate content. Seeds persistence into upstream document ingestion pipelines (S3 buckets, SharePoint, Git repos monitored by the RAG ingest daemon) to re-poison on each re-index. Requires RAGSTRIKE_UNLEASHED_KEY + ROE + --confirm-destroy.

Propagates poisoned embeddings across connected RAG pipelines sharing the same vector store backend. In multi-tenant deployments, adversarial documents injected into one tenant's collection cross-contaminate other tenants' retrieval results when namespace isolation is misconfigured. Maps downstream agent pipelines consuming the poisoned vector store and propagates adversarial content to each connected agent's knowledge context. Measures cascade depth: number of downstream RAG consumers confirmed to retrieve poisoned content. Requires RAGSTRIKE_UNLEASHED_KEY + ROE + --confirm-destroy.

Generates RGS-{hex12} session report. Collects all subsystem results. Produces structured JSON: collection inventory, CVEs exploited with CVSS scores, poison coverage percentage (adversarial documents as fraction of top-k retrieval), hallucination rate delta before/after, knowledge base reconstruction completeness, cascade breadth (connected consumers affected), and full evidence chain. Ed25519 signs with ~/.red-specter/ragstrike/signing_key.pem. ML-DSA-65 countersigns. MITRE ATT&CK and ATLAS mapping. Saves to ~/.red-specter/ragstrike/reports/.

5 CVEs. Unauthenticated REST API on default install. Full collection dump, arbitrary document injection, SSRF via custom embedding function callbacks. Most widely exploited vector store in RAG deployments.

REST /collections scroll endpoint unauthenticated on default config. gRPC reflection attack maps internal schema. Bulk vector and payload dump. Available REST and gRPC attack variants.

gRPC reflection probe enumerates collections and schemas. Unauthenticated data insert via Python SDK. Partition enumeration for multi-tenant deployments.

GraphQL introspection maps full schema including class properties and cross-references. Unauthenticated batch import via REST API. Module configuration disclosure via /v1/meta.

API key enumeration via credential theft from Flowise/AnythingLLM. Namespace enumeration and vector fetch. Metadata filter bypass to retrieve vectors across namespaces.

SQL injection via unsanitised nearest-neighbour query parameter in LangChain PGVector integration. Full database dump via UNION injection. Arbitrary vector insert via crafted SQL.

Local path traversal to read arbitrary .lance database files when LanceDB is mounted without access controls. Remote variant via LanceDB cloud API credential theft.

Keyspace scan identifies vector index keys. HGETALL dumps vector data and metadata. No auth on default Redis deployments. FT.SEARCH query to extract top-k vectors for any query embedding.

CVE-2026-45312 CVSS 9.9. RCE via /api/document/parse unsanitised filename passed to subprocess. Arbitrary command execution as application user. Tested v0.14.x–v0.18.x.

Index store path traversal via unsanitised persist_dir parameter. Reads arbitrary files from the host filesystem. Document store JSON disclosure. Storage context credential exfil.

Arbitrary Python deserialisation in vectorstore pickle loading. pgvector SQL injection. Unsafe document loader chain manipulation. RetrievalQA prompt injection via poisoned documents.

YAML pipeline injection — arbitrary Python class instantiation during Pipeline.from_yaml(). Document store connection string disclosure. Custom component RCE via untrusted pipeline YAML.

Unauthenticated /api/v1/credentials endpoint dumps all stored API keys, database connection strings, and OAuth tokens on default installations. No authentication required.

Admin API accessible without authentication on default installs. Full system configuration read/write. User account enumeration. Document workspace data exfiltration. System prompt disclosure.

SSRF via model endpoint URL parameter — operator can redirect model inference calls to internal services. Ingested document enumeration. Ollama backend credential disclosure.

Stored XSS via chat title field exfiltrates localStorage session tokens. Admin panel accessible to authenticated low-privilege users. RAG document collection dump via API.

Morris et al. arXiv:2310.16832. Demonstrates that text embeddings can be inverted to reconstruct the original text with high fidelity. SPECTER RAGSTRIKE implements Vec2Text to recover proprietary training corpus from stolen vectors — turning a vector database dump into a fully readable knowledge base reconstruction. The attack is particularly devastating for RAG systems storing confidential documents: the embeddings themselves constitute a data breach even without plaintext storage.

CVSS 9.9. Critical unauthenticated RCE in RAGFlow's document parsing API. The /api/document/parse endpoint constructs a subprocess call using unsanitised user input from the filename and content-type fields. An attacker sends a crafted multipart request with a payload filename containing shell metacharacters, achieving arbitrary command execution as the application user — typically the same account running the RAGFlow process with access to the underlying vector database.

FGSM (Fast Gradient Sign Method) adapted to the embedding space. For a target query class Q, computes the gradient of the nearest-neighbour distance function with respect to a document embedding, then applies a perturbation of epsilon=0.08 in the gradient direction. The resulting adversarial embedding is a nearest-neighbour match for Q in the vector metric space, ensuring the attacker-controlled document is retrieved for that query class. The perturbation is imperceptible at the text level.

RAG systems are uniquely vulnerable to retrieval-path attacks because: (1) vector databases typically have weaker access controls than the LLMs they serve, (2) document ingestion pipelines often trust any authenticated document source, (3) retrieval results are implicitly trusted by the LLM without content-level verification, and (4) hallucination amplification attacks require no code execution — only document injection. RAGSTRIKE demonstrates that the retrieval path is the most exploitable surface in production AI deployments.

T1190 — Exploit Public-Facing Application T1059 — Command and Scripting Interpreter T1552 — Unsecured Credentials T1565 — Data Manipulation T1530 — Data from Cloud Storage T1499 — Endpoint Denial of Service

AML.T0020 — Poison Training Data AML.T0043 — Craft Adversarial Data AML.T0048 — External Harms AML.T0054 — LLM Prompt Injection via RAG AML.T0057 — LLM Data Leakage