# CVE-2026-82526: SciPhi-AI R2R stacked SQL injection in vector index creation

Source: https://junglewise.ai/threats/cve-2026-82526-sciphi-ai-r2r-stacked-sql-injection-in-vector-index-creation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82526 · Severity: critical · CVSS 9.8 · Published 2026-09-03

R2R is a framework for building retrieval-augmented generation (RAG) applications. An unauthenticated attacker can exploit a SQL injection vulnerability in the vector index creation endpoint to execute arbitrary database commands, including reading, modifying, or deleting data, with no authorization checks required.

## Quick answers

**Is CVE-2026-82526 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82526 being exploited in the wild.

**How severe is CVE-2026-82526?** Critical severity, with a CVSS score of 9.8, published 3 September 2026.

**Which products and versions are affected?** SciPhi-AI R2R through 3.6.6.

**Is there a fix for CVE-2026-82526?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82526 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82526?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

R2R contains a stacked SQL injection vulnerability (CWE-89) in the vector index creation endpoint (/v3/indices POST) where the index name parameter is interpolated directly into a CREATE INDEX SQL statement via f-string formatting without identifier quoting or input validation. The vulnerable code constructs the SQL string without bound parameters and executes it via asyncpg's simple-query protocol, which allows multiple semicolon-separated SQL statements. On the default deployment with unauthenticated access enabled and the database role configured as PostgreSQL superuser, an unauthenticated attacker can execute arbitrary DDL and DML statements to read, write, or modify the entire database. The vulnerability requires network access to the vector index creation endpoint but no authentication or user interaction.

## Affected products

- SciPhi-AI R2R through 3.6.6

## Timeline

- 2026-09-01: disclosed
- 2026-09-03: advisory

## References

- [https://github.com/SciPhi-AI/R2R/issues/2309](https://github.com/SciPhi-AI/R2R/issues/2309)
- [https://www.vulncheck.com/advisories/r2r-sql-injection-via-vector-index-creation-endpoint](https://www.vulncheck.com/advisories/r2r-sql-injection-via-vector-index-creation-endpoint)