CVE-2026-108167

Python AI retrievers could reuse the wrong document permission decision

Okta/Auth0 · Auth0 AI Python LangChain and LlamaIndex FGA retrievers

First documented disclosure · Review checkpoint

Summary

The retrievers failed to distinguish authorization contexts associated with the same FGA object. A user could receive a model response based on documents that FGA denied.

Severity and exploitation evidence

Medium · 6.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The retrievers failed to distinguish authorization contexts associated with the same FGA object.

Conditions required

A retrieval included the same object under different users, relations or conditions.

Potential impact

A user could receive a model response based on documents that FGA denied.

Affected versions and configurations

The advisory’s affected-products section and CNA list auth0-ai-langchain before 1.0.2 and auth0-ai-llamaindex before 1.0.3. Its resolution paragraph uses narrower ranges.

Fix and mitigation status

auth0-ai-langchain 1.0.2 and auth0-ai-llamaindex 1.0.3.

Practical next steps

Install the recommended version for each integration and test document filtering across distinct users and conditions.

Operating lesson

Check the authority granted to the affected component against the operation a user expects.

Evidence and limits

The CVE record was published on 2026-11-10.

Sources