CVE-2026-82527: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SciPhi-AI R2R

CVE-2026-82527 is a SQL injection vulnerability affecting SciPhi-AI's R2R product up to version 3.6.6. The issue occurs because the filter key parameter in the retrieval search endpoint is directly interpolated into the SQL WHERE clause without parameterization or escaping. This allows unauthenticated attackers to inject SQL predicates, potentially enabling time-based and boolean-based data exfiltration from the application's database. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity. There is no vendor advisory or patch information available at this time.

An unauthenticated attacker can exploit this vulnerability to perform SQL injection attacks, potentially extracting sensitive data from the backend database. The vulnerability allows time-based and boolean-based data exfiltration, which can lead to unauthorized disclosure of information. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the vulnerable endpoint to untrusted users or implement additional input validation and filtering on the filter key parameter to mitigate injection risks.