CVE-2026-82526
Received Received - Intake

SQL Injection in R2R Vector Index Creation

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is interpolated directly into a CREATE INDEX statement via string formatting without identifier quoting or allowlist validation, enabling arbitrary DDL and DML execution through semicolon-separated statements under the PostgreSQL superuser account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-04
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-82526
EUVD
EUVD-2026-70653

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sciphi-ai r2r 3.6.6
sciphi-ai r2r to 3.6.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

R2R through 3.6.6 has a stacked SQL injection flaw where unauthenticated attackers can run arbitrary SQL commands by manipulating the index name parameter during vector index creation. The index name is directly inserted into a CREATE INDEX statement without proper quoting or validation, allowing attackers to execute multiple SQL statements separated by semicolons with PostgreSQL superuser privileges.

Detection Guidance

Detecting this vulnerability requires checking for unusual SQL queries or index creation attempts in your PostgreSQL logs. Look for CREATE INDEX statements with semicolon-separated commands or unexpected index names. Monitor network traffic for requests to the vector index creation endpoint with manipulated parameters.

Impact Analysis

This vulnerability allows attackers to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. Attackers could steal sensitive information, alter database contents, or take full control of the database server if it runs with superuser privileges.

Compliance Impact

This vulnerability could lead to severe compliance violations under GDPR and HIPAA due to unauthorized data access or exposure. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A successful exploit may result in data breaches, triggering mandatory breach notifications and potential fines.

Mitigation Strategies

Upgrade R2R to a version beyond 3.6.6 where this issue is patched. If immediate upgrade is not possible, restrict access to the vector index creation endpoint and implement strict input validation for the index name parameter. Review PostgreSQL logs for signs of exploitation and revoke unnecessary superuser privileges.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82526. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart