---
id: CVE-2026-82527
title: >-
  R2R through 3.6.6 contains a SQL injection vulnerability that allows
  unauthenticated attackers to inject SQL predicates into the chunks search
  query by manipulating the filter key parameter in the retrieval search
  endpoint
summary: >-
  R2R through 3.6.6 contains a SQL injection vulnerability that allows
  unauthenticated attackers to inject SQL predicates into the chunks search
  query by manipulating the filter key parameter in the retrieval search
  endpoint. Attackers can…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-89
published: '2026-09-03'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:45.723'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82527'
references:
  - url: 'https://github.com/SciPhi-AI/R2R/issues/2308'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/r2r-sql-injection-via-retrieval-search-filter-key
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00273
epssPercentile: 0.19897
ingestedAt: '2026-09-23T17:28:14.823Z'
---

## Overview

R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthenticated attackers to inject SQL predicates into the chunks search query by manipulating the filter key parameter in the retrieval search endpoint. Attackers can exploit the direct interpolation of filter keys into the SQL WHERE clause without parameterization or escaping to perform time-based and boolean-based data exfiltration from the application database.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.