CVE-2026-119337
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In RAGFlow from 0.25.2 until 0.27.3, the POST /api/v1/agents/chat/completions endpoint invokes completion_openai and returns through the OpenAI-compatible branch before UserCanvasService.accessible() checks access to the agent. An authenticated user who knows another user's private agent UUID can execute that workflow and read its output across the user or tenant boundary.
Risk Assessment
An attacker can run another user's private workflow without authorization and read its output, and configured tools may cause side effects. This breaks isolation between users and tenants.
Recommendation
Update RAGFlow to version 0.27.3 or later. Until then, restrict access to the agents endpoint and limit who knows agent UUIDs.
Other vulnerabilities in RAGFlow
See all- CVE-2026-51897Critical
RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution.
- CVE-2026-51893Critical
infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object.
- CVE-2026-45312Critical
RAGFlow 0.24.0 and earlier contain a Jinja2 template injection vulnerability in the prompt generator (rag/prompts/generator.py). This allows any authenticated user to execute arbitrary OS commands on the server.
- CVE-2026-24770Critical
RAGFlow is an open-source RAG engine. In version 0.23.1 and possibly earlier, the MinerU parser contains a 'Zip Slip' vulnerability, allowing an attacker to overwrite arbitrary files on the server (leading to Remote Code Execution) via a malicious ZIP archive. The MinerUParser class retrieves and extracts ZIP files from an external source (mineru_server_url). The extraction logic in `_extract_zip_no_root` fails to sanitize filenames within the ZIP archive. Commit 64c75d558e4a17a4a48953b4c201526431d8338f contains a patch.
- CVE-2025-69286Critical
RAGFlow is an open-source RAG engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta token generation process allows these tokens to be mutually derivable. Both tokens are generated using the same `URLSafeTimedSerializer` with predictable inputs, enabling an unauthorized user who obtains the shared assistant/agent URL to derive the personal API key. This grants full control over the assistant/agent owner's account. Version 0.22.0 fixes the issue.
- CVE-2026-51896Medium
infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py). Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations.
- CVE-2026-51895Medium
Ragflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps/kb_app.py). Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations.
- CVE-2026-51894Medium
infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run_mindmap. A reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object.
- CVE-2026-51892Medium
infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/<doc_id>.
- CVE-2026-93013Medium
RAGFlow through version 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints that allows authenticated attackers to read arbitrary files by supplying absolute file paths in the file_path parameter. Attackers with valid access tokens can exploit missing path validation to read any file accessible to the service, with disclosure limited to files matching expected JSON structures that are then written to datasets.
Original NVD description (English source)
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. From 0.25.2 until 0.27.3, POST /api/v1/agents/chat/completions invokes completion_openai and returns through the openai-compatible branch before UserCanvasService.accessible() checks whether the caller may access the requested agent. An authenticated user who knows another user's private agent UUID can execute that Only me workflow and read its output across the user or tenant boundary; configured tools may also cause side effects, but stronger impacts were not demonstrated. This issue is fixed in version 0.27.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS