CVE-2026-119337 in Ragflow
Summary
by MITRE • 10/30/2026
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. From 0.25.2 until 0.27.3, POST /api/v1/agents/chat/completions invokes completion_openai and returns through the openai-compatible branch before UserCanvasService.accessible() checks whether the caller may access the requested agent. An authenticated user who knows another user's private agent UUID can execute that Only me workflow and read its output across the user or tenant boundary; configured tools may also cause side effects, but stronger impacts were not demonstrated. This issue is fixed in version 0.27.3.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in RAGFlow versions ranging from 0.25.2 to 0.27.3 represents a critical authorization bypass within the Retrieval-Augmented Generation engine's API layer. This flaw specifically affects the POST /api/v1/agents/chat/completions endpoint, which is designed to handle chat completion requests using an OpenAI-compatible interface. The core technical issue stems from a race condition or logical error in the request processing pipeline where the system invokes the underlying model completion logic via the openai-compatible branch before executing the necessary access control checks performed by UserCanvasService.accessible(). This inversion of operations means that the computational resources are allocated and the response is generated prior to verifying whether the authenticated caller has permission to interact with the specific agent UUID being requested.
From a technical perspective, this constitutes an Insecure Direct Object Reference vulnerability as defined in CWE-639. The application relies on client-supplied identifiers for agents but fails to enforce proper authorization checks at the correct point in the execution flow. An authenticated attacker who possesses knowledge of another user's private agent UUID can exploit this sequence flaw to bypass tenant or user boundaries. By submitting a request with the target victim's agent identifier, the system processes the completion and returns the output without validating that the requester is authorized to access that specific resource. This allows for unauthorized data exfiltration where sensitive information processed by the AI model becomes accessible to unintended parties across organizational or multi-tenant boundaries.
The operational impact of this vulnerability extends beyond simple data leakage. While the primary demonstrated risk involves reading the output of workflows configured with restricted visibility, such as those marked as Only me, there are secondary implications related to tool execution side effects. If the agent utilizes connected tools that perform actions in external systems or databases, an attacker could potentially trigger these operations on behalf of another user. Although stronger impacts were not explicitly demonstrated in initial reports, the potential for unauthorized action execution remains a significant risk vector, particularly if integrated tools have write permissions or access to sensitive infrastructure components. This undermines the integrity and confidentiality guarantees expected from multi-tenant SaaS applications.
This vulnerability aligns with MITRE ATT&CK technique T1078, Valid Accounts, as it exploits existing authentication credentials to perform unauthorized actions due to flawed authorization logic. It also reflects aspects of T1530, Data from Cloud Storage, if the agent outputs contain sensitive data retrieved during processing. The failure to enforce access controls before resource consumption highlights a gap in secure coding practices regarding API endpoint design and security middleware ordering.
To mitigate this issue, organizations must upgrade RAGFlow to version 0.27.3 or later where the logic has been corrected to ensure that UserCanvasService.accessible() is invoked prior to processing completion requests. For environments unable to immediately patch, implementing a reverse proxy with strict access control policies can provide an additional layer of defense by validating user permissions against agent ownership before forwarding requests to the application backend. Additionally, developers should audit other API endpoints for similar ordering issues where business logic precedes security checks, ensuring that all resource accesses are gated behind robust authorization middleware regardless of the authentication status of the caller.