CVE-2026-82527 – SQL Injection (Unauthenticated Data Exfiltration) – SciPhi-AI R2R ≤ 3.6.6

Summary

CVE-2026-82527 is a SQL injection vulnerability in SciPhi-AI’s R2R retrieval-augmented generation (RAG) platform, affecting the POST /v3/retrieval/search endpoint. The flaw arises because filter keys supplied in search requests are interpolated directly into the SQL WHERE clause instead of being parameterized, allowing an attacker to inject arbitrary SQL predicates. Because R2R’s default configuration runs with require_authentication = false, the endpoint can be reachable without credentials, and injected queries execute under the database superuser account, making this a high-severity, network-exploitable issue.

Technical details

• Root cause: Filter values in R2R’s search API are bound as positional parameters ($1, $2, …), but filter keys are not. The vulnerable code builds JSONB accessors via string formatting, e.g. json_accessor_text = f"{json_column} ->> {quoted_key}", embedding the attacker-controlled key directly into the query text (in filters.py‘s _build_metadata_operator_condition() and chunks.py‘s full_text_search()).
• Trigger conditions: Sending a crafted filters object to the retrieval search endpoint where a filter key contains a single quote or other SQL metacharacters breaks out of the intended string literal and injects additional SQL logic.
• Attack vector: Network-reachable, unauthenticated in default deployments (require_authentication = false maps anonymous requests to the superuser database role), requiring no user interaction.
• Impact: Boolean-based and time-based blind SQL injection enabling exfiltration of database contents. A proof-of-concept using a filter key such as x' IS NOT NULL OR (SELECT pg_sleep(5)) IS NULL OR 'a produced a measurable ~5 second response delay, confirming arbitrary SQL execution against the backing PostgreSQL database.

Affected software

• Product: SciPhi-AI R2R (Retrieval-Augmented Generation platform)
• Versions: All versions through 3.6.6, including the main branch up to commit 9c5a94d151f90876bd7eb860f300a8fd662dc481

Severity

• CVSS v3.1: 7.5 (HIGH) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• CVSS v4.0: 8.7 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Mitigation and recommended actions

• Immediate: Upgrade to a version of R2R newer than 3.6.6 that binds JSON path/filter-key segments as parameters (or validates them against an allowlist such as [A-Za-z0-9_]+ / uses quote_ident) rather than interpolating them into SQL strings. Confirm the fix is present before considering an instance remediated, as no official patched release number was identified at time of writing.
• If no patch is available:
  • Enable authentication (require_authentication = true) so the retrieval search endpoint cannot be reached anonymously, and ensure the application does not run under a database superuser role.
  • Restrict network exposure of the R2R API to trusted internal networks only; do not expose the retrieval search endpoint directly to the internet.
  • Apply a WAF rule or reverse-proxy filter to reject requests containing SQL metacharacters (e.g., single quotes) in filter key names.
  • Run the R2R application’s database connection with least-privilege credentials rather than a superuser account, to limit the blast radius of any successful injection.
  • Monitor database logs for anomalous long-running queries or pg_sleep-style time-based injection patterns on the retrieval search endpoint.

References

• CVE-2026-82527 Record (CVE Project)
• SciPhi-AI/R2R Issue #2308 (Technical Writeup)
• VulnCheck Advisory: R2R SQL Injection via Retrieval Search Filter Key