CVE-2026-121585

RAGFlow text-to-SQL retrieval can read across tenant boundaries

InfiniFlow · RAGFlow text-to-SQL retrieval

First documented disclosure · Review checkpoint

Summary

Insufficient tenant authorization permits cross-dataset reads.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The CNA records a public demonstration, and CISA enrichment marks proof of concept. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The text-to-SQL retrieval layer did not consistently restrict queries to datasets authorized for the current tenant.

Conditions required

Network access and low privileges are reflected in the CNA score. The issue concerns the listed text-to-SQL retrieval implementation.

Potential impact

A user may read knowledge-base data from another tenant.

Affected versions and configurations

0.27.0–0.27.2 and 1.0.0-rc1–rc2 per CNA.

Fix and mitigation status

Named fix not verified. Cited PR is unmerged.

Practical next steps

Restrict access to text-to-SQL retrieval and verify tenant isolation before enabling it on shared systems.

Operating lesson

Scope dataset access using the authenticated tenant throughout query generation and execution.

Evidence and limits

The CNA lists affected releases. One cited upstream issue was inaccessible and the linked pull request is unmerged. A fixed release could not be verified.

Sources