CVE-2026-119337

RAGFlow compatible API bypasses private-agent authorization

InfiniFlow · RAGFlow agent completion API

First documented disclosure · Review checkpoint

Summary

A signed-in user who knows a private agent UUID can run its workflow and read its output.

Severity and exploitation evidence

High · 7.1/10 · CVSS 3.1. Severity source.

Exploitation not established: Controlled research or code-path evidence; the reviewed sources do not establish malicious exploitation or a confirmed victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The OpenAI-compatible completion branch returned before the private-canvas access check, bypassing the authorization applied on the normal path.

Conditions required

A valid user account/API key and the UUID of another user’s private agent in an affected installation.

Potential impact

Unauthorized private-workflow execution and output disclosure across user or tenant boundaries. Additional retrieved-data exposure or tool side effects depend on configuration and were not demonstrated in the cited test.

Affected versions and configurations

0.25.2 through 0.27.2 (CNA: >=0.25.2 and <0.27.3).

Fix and mitigation status

0.27.3 per CNA and the release containing PR #19817.

Practical next steps

Upgrade to a supported fixed release and verify authorization on every completion format; review private-agent execution logs for unexpected callers.

Operating lesson

An API compatibility branch must preserve the same authorization boundary as the original endpoint.

Evidence and limits

The public authorization fix PR is September 18; detailed GHSA October 5; release October 23; CVE October 30. The GHSA’s old “None” patched-version field is superseded by the CNA and published 0.27.3 release, both reviewed.

Sources