CVE-2026-82526CWE-89sql-injection

CVE-2026-82526

Critical · published September 3, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
52.9
In the wild
Unconfirmed
What it is

R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is interpolated directly into a CREATE INDEX statement via string formatting without identifier quoting or allowlist validation, enabling arbitrary DDL and DML execution through semicolon-separated statements under the PostgreSQL superuser account.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00707 · 52.9th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-09-03T23:17Z
References (2)
https://github.com/SciPhi-AI/R2R/issues/2309 · [email protected]https://www.vulncheck.com/advisories/r2r-sql-injection-via-vector-index-creation-endpoint · [email protected]
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 18:12Z
    R2R 3.6.6 SQL Injection via Vector Index Creation Endpoint
    cvelistv5