CVE-2026-119337 Details
Description
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. From 0.25.2 until 0.27.3, POST /api/v1/agents/chat/completions invokes completion_openai and returns through the openai-compatible branch before UserCanvasService.accessible() checks whether the caller may access the requested agent. An authenticated user who knows another user's private agent UUID can execute that Only me workflow and read its output across the user or tenant boundary; configured tools may also cause side effects, but stronger impacts were not demonstrated. This issue is fixed in version 0.27.3.
A vulnerability exists in RAGFlow versions 0.25.2 prior to 0.27.3, allowing authenticated users to bypass authorization checks for private agents. When 'openai-compatible' is set to true, the 'POST /api/v1/agents/chat/completions' endpoint invokes a completion function without verifying if the user has access to the requested agent. This flaw enables users to execute another user's private agent workflow and access its output, potentially crossing user or tenant boundaries. The issue is compounded by the fact that some configured tools could introduce side effects, although more severe impacts were not observed.
Users can update to RAGFlow version 0.27.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/infiniflow/ragflow/security/advisories/GHSA-c6q8-23rp-32cv | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/infiniflow/ragflow/commit/20180790e1a8c55553a2f3e75718f3d65178ae6d | [email protected] | Source CodeVendor |
| https://github.com/infiniflow/ragflow/pull/19817 | [email protected] | Source CodeVendor |
| https://github.com/infiniflow/ragflow/releases/tag/v0.27.3 | [email protected] | Release NotesVendor |
| https://github.com/infiniflow/ragflow/security/advisories/GHSA-c6q8-23rp-32cv | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| infiniflow RAGFlow | >= 0.25.2, <= 0.27.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |