CVE-2026-82527: R2R 3.6.6 SQL Injection via Retrieval Search Filter Key
R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthenticated attackers to inject SQL predicates into the chunks search query by manipulating the filter key parameter in the retrieval search endpoint. Attackers can exploit the direct interpolation of filter keys into the SQL WHERE clause without parameterization or escaping to perform time-based and boolean-based data exfiltration from the application database.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker able to reach the R2R retrieval search endpoint can exploit it. No privileges or user interaction are required.
What data is at risk?
An attacker can use time-based or boolean-based SQL injection techniques to exfiltrate data from the application database. The reported impact is confidentiality loss; integrity and availability impacts are not indicated.
What input is vulnerable?
The filter key parameter in the retrieval search endpoint is vulnerable because filter keys are directly interpolated into the chunks search query's SQL WHERE clause without parameterization or escaping.
Which versions should be investigated?
R2R versions through 3.6.6 are reported as affected. The provided information does not identify a fixed version or a configuration-based workaround.