Read the docs
TI-2026-83381 Aliases CVE-2026-119337

Missing authorization in RAGFlow agent completions exposes private agents

Priority MEDIUM 64CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

RAGFlow from 0.25.2 before 0.27.3 lets an authenticated user run another user's private agent when the user knows its UUID. The POST /api/v1/agents/chat/completions endpoint returns the agent output before checking access, which is a missing authorization flaw (CWE-862). An attacker with low privileges can read the output of that private workflow across user and tenant boundaries, and configured tools may cause side effects. Proof-of-concept exploit code is reported, but the flaw is not listed in CISA KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. From 0.25.2 until 0.27.3, POST /api/v1/agents/chat/completions invokes completion_openai and returns through the openai-compatible branch before UserCanvasService.accessible() checks whether the caller may access the requested agent. An authenticated user who knows another user's private agent UUID can execute that Only me workflow and read its output across the user or tenant boundary; configured tools may also cause side effects, but stronger impacts were not demonstrated. This issue is fixed in version 0.27.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00335 27th percentileScored 2026-11-07
Fix Fixed ragflow (infiniflow): 0.27.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
infiniflowragflow0.25.2 to before 0.27.30.27.3Patch availableCNA
  • ragflow Vendorinfiniflow Affected 0.25.2 to before 0.27.3 Fixed in 0.27.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:infiniflow:ragflow:*:*:*:*:*:*:*:*——infiniflow
  • cpe:2.3:a:infiniflow:ragflow:*:*:*:*:*:*:*:* Versions — — ·infiniflow

Remediation

Upgrade infiniflow RAGFlow to version 0.27.3, which fixes the flaw. The sources list no other fixed version for ragflow.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA ragflow (infiniflow) Fixed in 0.27.3

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119337
  2. 2026-11-01 Priority changed: MEDIUM → LOW
  3. 2026-11-06 CISA SSVC decision points changed
  4. 2026-11-06 Priority changed: LOW → MEDIUM

References

Other 4

  • TI-2026-19971 RAGFlow Affected by Zip Slip Remote Code Execution (RCE) in MinerUParser CVSS 3.1CRITICAL 9.8
  • TI-2025-30545 Missing brute-force protection in infiniflow RAGFlow CVSS 3.1CRITICAL 9.8
  • TI-2024-11535 Remote Code Execution in infiniflow/ragflow CVSS 3.0CRITICAL 9.8
  • TI-2025-42731 RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability CVSS 4.0HIGH 8.9
  • TI-2025-19992 RAGFlow SQL Injection vulnerability CVSS 4.0HIGH 8.9
  • TI-2026-33111 RAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution CVSS 3.1CRITICAL 9.9
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences