Vulnerability · Published Sep 3, 2026 · Assigned by VulnCheck

CVE-2026-82527R2R 3.6.6 SQL Injection via Retrieval Search Filter Key

High 7.5

In plain English

A high-severity SQL injection in R2R from SciPhi-AI. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 59.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthenticated attackers to inject SQL predicates into the chunks search query by manipulating the filter key parameter in the retrieval search endpoint. Attackers can exploit the direct interpolation of filter keys into the SQL WHERE clause without parameterization or escaping to perform time-based and boolean-based data exfiltration from the application database.

Affected products (as reported)

Vendor	Product	Versions
SciPhi-AI	R2R	0 – through 3.6.60 – through 9c5a94d151f90876bd7eb860f300a8fd662dc481

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Researcher Disclosure technical-description, exploit
https://www.vulncheck.com/advisories/r2r-sql-injection-via-retrieval-search-filter-key third-party-advisory