# CVE-2026-82527: R2R SQL injection in retrieval search filter

Source: https://junglewise.ai/threats/cve-2026-82527-r2r-sql-injection-in-retrieval-search-filter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82527 · Severity: high · CVSS 7.5 · Published 2026-09-03

R2R is an open-source platform for semantic search and retrieval-augmented generation. A SQL injection vulnerability in the retrieval search endpoint allows unauthenticated attackers to extract sensitive data from the application database by crafting malicious filter parameters, potentially exposing customer documents, metadata, and other stored information.

## Quick answers

**Is CVE-2026-82527 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82527 being exploited in the wild.

**How severe is CVE-2026-82527?** High severity, with a CVSS score of 7.5, published 3 September 2026.

**Which products and versions are affected?** SciPhi-AI R2R through 3.6.6.

**Is there a fix for CVE-2026-82527?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82527 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82527?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a SQL injection vulnerability (CWE-89) in the chunks search query endpoint. The root cause is direct interpolation of client-supplied filter keys into the SQL WHERE clause without parameterization or escaping in py/core/providers/database/filters.py (_build_metadata_operator_condition function). An unauthenticated attacker can inject arbitrary SQL predicates via the filter key parameter in POST /v3/retrieval/search, exploiting the default configuration where require_authentication = false maps unauthenticated requests to the superuser account. Attack preconditions are minimal: the attacker needs network access to the retrieval search endpoint. Confirmed attacks include time-based and boolean-based data exfiltration from the r2r_default.chunks table, though stacked queries are blocked by asyncpg prepared statements. Patches are expected to bind JSON path segments as parameters or enforce allowlisting rather than raw string interpolation.

## Affected products

- SciPhi-AI R2R through 3.6.6

## Timeline

- 2026-09-01: disclosed
- 2026-09-03: advisory

## References

- [https://github.com/SciPhi-AI/R2R/issues/2308](https://github.com/SciPhi-AI/R2R/issues/2308)
- [https://www.vulncheck.com/advisories/r2r-sql-injection-via-retrieval-search-filter-key](https://www.vulncheck.com/advisories/r2r-sql-injection-via-retrieval-search-filter-key)