Skip to content
OpenAdvisories

Vendor

SciPhi-AI

5 known vulnerabilities.

Products

R2R 5
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.3
    CVE-2026-105148

    SciPhi-AI R2R Retrieval Completion API Endpoint llm.py server-side request forgery

    A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown code of the file py/shared/abstractions/llm.py of the component Retrieval Completion API Endpoint. Such manipulation of the argument generation_config.api_base lea…

    SciPhi-AI R2R
  • High 7.3
    CVE-2026-105147

    SciPhi-AI R2R JWT Secret hard-coded credentials

    A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULT_BCRYPT_SECRET_KEY/DEFAULT_NACL_SECRET_KEY causes hard-coded credentials. The attack can be…

    SciPhi-AI R2R
  • High 7.5
    CVE-2026-82527

    R2R 3.6.6 SQL Injection via Retrieval Search Filter Key

    R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthenticated attackers to inject SQL predicates into the chunks search query by manipulating the filter key parameter in the retrieval search endpoint. Attackers can exploit the direct in…

    SciPhi-AI R2R