SQL Injection Vulnerability in R2R by SciPhi-AI
CVE-2026-82527

8.7HIGH

Key Information:

Vendor

Sciphi-ai

Status
R2r
Vendor
CVE Published:
3 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-82527?

R2R version 3.6.6 has a SQL injection vulnerability that enables unauthorized users to inject malicious SQL predicates into the search query. By exploiting the manipulation of the filter key parameter in the retrieval search endpoint, attackers can execute both time-based and boolean-based attacks to extract sensitive data directly from the application database. This exploitation occurs due to the lack of proper parameterization and escaping when incorporating filter keys into the SQL WHERE clause, making it a significant risk for data integrity and confidentiality.

Affected Version(s)

R2R 0 <= 3.6.6

R2R 0 <= 9c5a94d151f90876bd7eb860f300a8fd662dc481

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-82527 - Proof of Concept

References

https://github.com/SciPhi-AI/R2R/issues/2308
technical-descriptionexploit
https://www.vulncheck.com/advisories/r2r-sql-injection-vi...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Snkn0w
.