CVE-2026-82526 — R2R 3.6.6 SQL Injection via Vector Index Creation Endpoint
R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name paramet…
Published: 2026-09-03 · CVSS: 9.3 · CVSS 4.0
R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is interpolated directly into a CREATE INDEX statement via string formatting without identifier quoting or allowlist validation, enabling arbitrary DDL and DML execution through semicolon-separated statements under the PostgreSQL superuser account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7