CVE-2026-119337
RAGFlow: OpenAI-compatible agent completion bypasses private canvas authorization
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. From 0.25.2 until 0.27.3, POST /api/v1/agents/chat/completions invokes completion_openai and returns through the openai-compatible branch before UserCanvasService.accessible() checks whether the caller may access the requested agent. An authenticated user who knows another user's private agent UUID can execute that Only me workflow and read its output across the user or tenant boundary; configured tools may also cause side effects, but stronger impacts were not demonstrated. This issue is fixed in version 0.27.3.
| CWE | CWE-862 |
| Vendor | infiniflow |
| Product | ragflow |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for infiniflow ragflow
Be the first to know when new high vulnerabilities affecting infiniflow ragflow are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
infiniflow / ragflow
>= 0.25.2, < 0.27.3
References
github.com: https://github.com/infiniflow/ragflow/security/advisories/GHSA-c6q8-23rp-32cv github.com: https://github.com/infiniflow/ragflow/pull/19817 github.com: https://github.com/infiniflow/ragflow/commit/20180790e1a8c55553a2f3e75718f3d65178ae6d github.com: https://github.com/infiniflow/ragflow/releases/tag/v0.27.3