HighVulnerability

CVE-2026-119337: RAGFlow agent chat completions API bypasses access check on private agents

Source: NVD(opens in a new tab)
Identifier: CVE-2026-119337
Published: October 30, 2026
Record updated: October 30, 2026

Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.

Summary

RAGFlow versions 0.25.2 through 0.27.3 call completion_openai in POST /api/v1/agents/chat/completions before UserCanvasService.accessible() checks access to the requested agent. An authenticated user who knows another user's private agent UUID can run that Only me workflow and read its output across user or tenant boundaries, and configured tools may cause side effects, though stronger impacts were not demonstrated.

Mitigation

Fixed in version 0.27.3.

Details

Scores and exploitation

CVSS score: 7.1(high)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Attack vector: network
Attack complexity: low
Privileges required: low
User interaction: none
EPSS: Not scored. FIRST had not published an EPSS score for this CVE when it was last checked on October 30, 2026.
Disclosure date: October 30, 2026

Weaknesses and techniques

Weakness (CWE): CWE-862
Attack pattern (CAPEC): CAPEC-122

Classification

Attack type: Other
Attack sophistication: Trivial
AI component targeted: Agent
Impact: Confidentiality,
Integrity
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative. The source gives this advisory a description and no title, so the title above is a headline generated from the source text.

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-119337

First tracked: October 30, 2026 at 08:09 PM ET, from NVD/CVE Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 93% (self-assessed)

Topics

Retrieval-augmented generation

Summary

Mitigation

Topics

Related items