CVE-2026-121585 in RAGFlow
Summary
by MITRE • 11/04/2026
A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file internal/engine/infinity/sql.go of the component Text To SQL Retrieval. The manipulation of the argument tableName/kbIDs results in authorization bypass. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/04/2026
A critical security vulnerability has been identified within InfiniFlow RAGFlow, specifically affecting versions up through 0.27.2 and 1.0.0-rc2. This flaw resides in the Text To SQL Retrieval component, which is responsible for translating natural language queries into executable database commands to retrieve relevant information from knowledge bases. The vulnerability centers on a logic error within the RunSQL function located in the internal/engine/infinity/sql.go source file. Specifically, the issue arises during the manipulation of arguments passed to this function, namely tableName and kbIDs. These parameters are intended to restrict SQL queries to specific tables or knowledge base identifiers, thereby enforcing data isolation boundaries between different users or tenants. However, due to insufficient validation and sanitization logic within the implementation, an attacker can manipulate these inputs to bypass authorization controls.
The core technical flaw is a form of Insecure Direct Object Reference combined with Authorization Bypass using Common Criteria weaknesses. When the RunSQL function processes user-supplied input for tableName or kbIDs, it fails to adequately verify that the requesting entity has legitimate permission to access the specified resource. Instead of strictly enforcing ownership checks against the authenticated session's context, the system relies on the integrity of these arguments without sufficient cross-referencing against a secure authorization matrix. This allows an attacker who is already authenticated as a low-privilege user or even potentially unauthenticated if other controls are weak to inject crafted values that point to restricted tables or knowledge bases belonging to other users or administrative systems. By altering the tableName or kbIDs parameters, the malicious actor can trick the database engine into executing queries against data they should not have access to, effectively bypassing the application-level security boundaries designed to protect sensitive information.
The operational impact of this vulnerability is severe, as it leads directly to unauthorized data exposure and potential privilege escalation within the RAGFlow environment. Since RAGFlow often handles proprietary or confidential documents stored in knowledge bases, an attacker exploiting this flaw could extract sensitive text snippets, metadata, or entire datasets from restricted sources. This compromises the confidentiality integrity of the system's primary function, which is secure retrieval-augmented generation. Furthermore, because SQL injection techniques can sometimes be chained with authorization bypasses, there may also be risks associated with data manipulation if write operations are permitted through similar pathways, although the primary reported impact is unauthorized read access. The ability to perform this attack remotely means that no physical or local network proximity is required, significantly expanding the attack surface and making it a high-priority threat for any deployment of RAGFlow exposed to external networks.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-639 Authorization Bypass Through User-Controlled Key in the Common Weakness Enumeration standard. It also maps closely to MITRE ATT&CK technique T1078 Valid Accounts, where an attacker uses legitimate credentials but exploits a flaw to access resources outside their intended scope, potentially leading to data exfiltration techniques described under TA0009 Collection and TA0010 Exfiltration. The fact that the exploit has been released publicly increases the urgency for remediation, as automated scanning tools and malicious actors can now easily identify vulnerable instances on the internet. Organizations running affected versions must treat this as a critical priority to prevent data breaches resulting from unauthorized access to their knowledge bases.
Mitigation strategies should focus primarily on immediate patching and rigorous input validation. The most effective solution is to upgrade InfiniFlow RAGFlow to a version where this flaw has been patched by the developers, ensuring that the RunSQL function properly validates tableName and kbIDs against the authenticated user's permissions before executing any database queries. In the interim, if upgrading is not immediately feasible, administrators should implement strict network-level controls such as firewalls or Web Application Firewalls to restrict access to the RAGFlow interface only from trusted IP addresses. Additionally, deploying intrusion detection systems that can identify SQL-like patterns in query parameters may help mitigate exploitation attempts until a permanent fix is applied. Regular security audits and penetration testing of the authentication and authorization modules are recommended to ensure no other similar logic flaws exist within the application's data access layer.