CVE-2026-82527

R2R through version 3.6.6 contains a SQL injection flaw (CWE-89) in the retrieval search endpoint, where the filter key parameter is directly interpolated into the SQL WHERE clause of the chunks search query without parameterization or escaping. An unauthenticated remote attacker can manipulate this parameter to inject arbitrary SQL predicates into the query. Because the injection supports time-based and boolean-based techniques, an attacker can blindly exfiltrate confidential data from the application database even without seeing query output directly. Any deployment running R2R at version 3.6.6 or earlier with the retrieval search endpoint reachable is affected. Exploitation has not yet been observed: there is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% probability of exploitation in the next 30 days.

What to do: Upgrade R2R to a release newer than 3.6.6 that addresses the unparameterized filter key interpolation; no specific fixed version number is provided in the disclosure data, so verify the patched release with the vendor. Until patching, restrict network access to the retrieval search endpoint (ideally requiring authentication or placing it behind a WAF/reverse proxy that filters the filter key parameter). Check access logs for unusual repeated search requests with manipulated filter keys or abnormal response timing, which would indicate attempted time-based or boolean-based exfiltration.