CVE-2026-119337highBroken access control2026-10-30
CVE-2026-119337: RAGFlow's OpenAI-compatible endpoint lets any user run another user's private agent, upgrade to 0.27.3
From 0.25.2 until 0.27.3, RAGFlow's POST /api/v1/agents/chat/completions returned through its OpenAI-compatible branch before checking whether the caller may use the agent. Any logged-in user who knows the UUID of someone else's 'Only me' agent can run it and read its output across user or tenant boundaries.
What it is
With "openai-compatible": true, the endpoint calls completion_openai and returns before UserCanvasService.accessible() checks access to the requested agent.
An authenticated user with a valid account or API key and the victim agent's UUID can execute that private workflow and read its output.
The advisory notes that tools configured in the agent may also cause side effects, though stronger impacts were not demonstrated.
How to check
- Check your RAGFlow version: 0.25.2 through 0.27.2 are affected.
- Check whether more than one user or tenant shares your RAGFlow instance and whether private agents use tools with side effects.
How to fix
- Upgrade RAGFlow to 0.27.3 or later.
- Until then, limit who has accounts or API keys on a shared instance, and avoid side-effecting tools in private agents.