CVE-2026-119337: high-severity vulnerability in infiniflow ragflow
RAGFlow: OpenAI-compatible agent completion bypasses private canvas authorization
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.3%
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. From 0.25.2 until 0.27.3, POST /api/v1/agents/chat/completions invokes completion_openai and returns through the openai-compatible branch before UserCanvasService.accessible() checks whether the caller may access the requested agent. An authenticated user who knows another user's private agent UUID can execute that Only me workflow and read its output across the user or tenant boundary; configured tools may also cause side effects, but stronger impacts were not demonstrated. This issue is fixed in version 0.27.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected products
infiniflow · ragflowRelated CVEs — infiniflow ragflow
In the same product, most dangerous first.
CVE-2026-24770CRITICALRAGFlow Affected by Zip Slip Remote Code Execution (RCE) in MinerUParserEPSS 1.4%CVE-2025-69286HIGHRAGFlow has Predictable Token Generation Leading to Authentication Bypass VulnerabilityEPSS 0.8%CVE-2025-68700HIGHRAGFlow Remote Code Execution VulnerabilityEPSS 0.7%CVE-2025-27135HIGHRAGFlow SQL Injection vulnerabilityEPSS 0.6%CVE-2026-28797HIGHRAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" ComponentEPSS 0.6%CVE-2026-93013MEDIUMRAGFlow through 0.27.2 Tenant Import Endpoints Path TraversalEPSS 0.5%