Two SQL injection flaws in SciPhi-AI’s R2R platform hand unauthenticated attackers full PostgreSQL superuser access
Two critical SQL injection vulnerabilities in R2R, an open-source retrieval-augmented generation platform from SciPhi-AI, allow unauthenticated remote attackers to execute arbitrary queries with PostgreSQL superuser privileges. The flaws, disclosed by Ionix Threat Center this week, affect all R2R versions through 3.6.6. No patch is available.
The vulnerabilities matter beyond one open-source project. They fit a 2026 pattern where AI infrastructure middleware – the layer between models and production data – is becoming the primary attack surface for adversaries targeting agent-native systems.
CVE-2026-82526: Stacked SQLi at the index creation layer
The more severe flaw (CVSS 9.8) sits in R2R’s vector index creation endpoint. When a client supplies an index name, the server interpolates it directly into a PostgreSQL CREATE INDEX statement without identifier quoting or allowlist validation. An attacker can append additional SQL statements – stacked queries – that execute with the database’s default superuser privileges.
The root cause is straightforward: string concatenation where parameterized queries or PostgreSQL’s quote_ident() should be. R2R’s default configuration compounds the problem – require_authentication is set to false, meaning the endpoint is reachable without credentials by default.
The practical impact is RCE-level database compromise. An attacker can read, modify, or delete any data the superuser account touches, including stored embeddings, document metadata, and potentially adjacent database objects.
CVE-2026-82527: Filter key injection at retrieval time
The second flaw (CVSS 8.7) targets R2R’s retrieval search endpoint (POST /v3/retrieval/search). Filter keys supplied in search requests are interpolated into SQL WHERE clauses via f-string JSONB accessor construction – for example, f"{json_column} ->> {quoted_key}" – rather than being parameterized.
The asymmetry is the tell: filter values are bound as positional parameters ($1, $2, etc.), but filter keys are not. This is the kind of oversight that survives code review because the values look safe. The keys, which carry the injection payload, are where the real risk sits.
Time-based blind injection via pg_sleep and boolean-based exfiltration are both viable. Same default auth bypass applies.
The middleware pattern is the real story
R2R is not the first AI infrastructure middleware to ship unauthenticated SQL injection in 2026. LiteLLM Proxy (CVE-2026-42208, CVSS 9.3) concatenated bearer tokens directly into SELECT statements – first exploitation was detected 36 hours after public disclosure, and CISA added it to the Known Exploited Vulnerabilities catalog in May. AWS’s MCP Gateway Registry (CVE-2026-14471) shipped authenticated SQLi in its metrics-service retention policy subsystem in July.
The common thread: middleware that sits between agents and data stores is being built fast, often by small teams, and the database interaction layer is where the shortcuts land. Parameterized queries are not a novel defense. But when the product is moving quickly and the default config is permissive, the basics get skipped.
For teams running R2R in production, Ionix recommends enforcing authentication on all API endpoints, switching to least-privilege database credentials, applying strict input validation (e.g., [A-Za-z0-9_]+) on index-name identifiers, and deploying a WAF to block SQL metacharacters. Until a fixed release ships, the authentication default is the most immediate lever.
The broader takeaway: as agent-native architectures proliferates, the middleware layer – where agents interact with vector stores, knowledge graphs, and retrieval endpoints – is where the security debt is accumulating fastest. SQL injection is not a novel class. It is a solved problem in mature web frameworks. Its reappearance in AI infrastructure middleware says more about the pace of development than the sophistication of attackers.