CVE-2026-82526: R2R 3.6.6 SQL Injection via Vector Index Creation Endpoint
R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is interpolated directly into a CREATE INDEX statement via string formatting without identifier quoting or allowlist validation, enabling arbitrary DDL and DML execution through semicolon-separated statements under the PostgreSQL superuser account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
R2Rto a version that resolves this vulnerability.Fixed in 3.6.6 - Compensating control
Disable or restrict access to the vector index creation endpoint to prevent unauthenticated attackers from manipulating the index name parameter and triggering stacked SQL injection.
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Any unauthenticated network-accessible attacker can exploit it. No privileges or user interaction are required.
What access does successful SQL injection provide?
Injected statements execute under the PostgreSQL superuser account. An attacker can execute arbitrary SQL, including DDL and DML statements, by supplying semicolon-separated commands in the index name.
Which deployments are affected?
R2R versions through 3.6.6 are affected. Exposure requires the vector index creation endpoint to be reachable by an attacker.