RAGFlow: OpenAI-compatible agent completion bypasses private canvas authorization
Impact
RAGFlow versions 0.25.2 to 0.27.3 have a weakness where an authenticated user can bypass private canvas authorization and access another user's private agent. The impact allows reading the output of the accessed agent.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
infiniflow · GitHub_M
ragflow
1 range
infiniflow · GitHub_M
ragflow
Compare with this publisher’s ranges. This does not inspect your installation.
affected
>= 0.25.2, < 0.27.3
Other versions: unknown
Original source description
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. From 0.25.2 until 0.27.3, POST /api/v1/agents/chat/completions invokes completion_openai and returns through the openai-compatible branch before UserCanvasService.accessible() checks whether the caller may access the requested agent. An authenticated user who knows another user's private agent UUID can execute that Only me workflow and read its output across the user or tenant boundary; configured tools may also cause side effects, but stronger impacts were not demonstrated. This issue is fixed in version 0.27.3.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-119337View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 1
Assigning organization
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.