CVE-2026-82526

R2R 3.6.6 SQL Injection via Vector Index Creation Endpoint

CRITICAL 9.3EPSS 0.7%

R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is interpolated directly into a CREATE INDEX statement via string formatting without identifier quoting or allowlist validation, enabling arbitrary DDL and DML execution through semicolon-separated statements under the PostgreSQL superuser account.

Affected: SciPhi-AI · R2R
CVSS v4.0 VULNCHECK: 9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 VULNCHECK: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.71% chance of exploitation in the next 30 days, 53rd percentile
Published: 2026-09-03
Updated: 2026-09-04

Proof-of-concept exploits (1)

SciPhi-AI/R2R/issues/23098015★ · 2025-11-07

CVE-2026-82526

Proof-of-concept exploits (1)

References

Related