CVE-2026-108167: auth0-ai-python: FGA retriever leaks denied RAG docs

AWAITING NVD

Published November 10, 2026

CISO Take

The Auth0 FGA retriever in auth0-ai-python fails to distinguish authorization checks made under different users, relations, or conditions, so documents that Auth0 FGA denied can still land in the LLM context and surface in generated answers. This is a broken access control flaw (CWE-863) in a core RAG authorization layer, meaning the safeguard teams deploy specifically to stop data leakage can silently fail, exposing confidential content to unauthorized users. No CVSS, EPSS, KEV, or public exploit data is available yet and no exploitation has been reported, but exploitation needs nothing more than a normal user query against an affected RAG app, and the package already has 8 other CVEs. Review the Okta advisory (CVE-2026-108167), upgrade to the fixed auth0-ai-python release as soon as it is available, and meanwhile audit RAG responses for content that users should not be able to see.

Sources:NVDtrust.okta.comATLAS

What is the risk?

Severity is not yet scored, but the practical risk is moderate to high for any deployment that depends on Auth0 FGA to enforce document-level access in RAG. Exploitation requires no special skills: an authenticated user simply queries the system and receives content that FGA should have denied. Exposure scales with the sensitivity of the indexed corpus (HR, legal, finance, customer data) and the number of users with different permissions. No known exploitation, public exploit, or scanner template exists at this time. Note that the affected-product data is incomplete, with no version ranges or patched versions listed.

How does the attack unfold?

Initial Access

A legitimate user with limited permissions interacts with a RAG application that uses the Auth0 FGA retriever.

AML.T0040

Exploitation

The user submits queries that match restricted documents, and the retriever fails to apply per-user and per-relation FGA decisions.

AML.T0085.000

Collection

Documents denied by FGA are included in the model context alongside permitted ones.

AML.T0036

Impact

The LLM reveals the unauthorized content in its response, causing confidentiality loss and potential compliance violations.

AML.T0057

Initial Access

A legitimate user with limited permissions interacts with a RAG application that uses the Auth0 FGA retriever.

AML.T0040

Exploitation

The user submits queries that match restricted documents, and the retriever fails to apply per-user and per-relation FGA decisions.

AML.T0085.000

Collection

Documents denied by FGA are included in the model context alongside permitted ones.

AML.T0036

Impact

The LLM reveals the unauthorized content in its response, causing confidentiality loss and potential compliance violations.

AML.T0057

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LlamaIndex	pip	—	No patch
52.8KPushed 7d ago22% patched~4d to patchFull package profile →
auth0-ai-langchain	—	—	No patch

How severe is it?

CVSS 3.1

N/A

EPSS

0.2%

chance of exploitation in 30 days

Higher than 8% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Read the Okta advisory and upgrade auth0-ai-python and the auth0-ai-langchain and auth0-ai-llamaindex integrations to the fixed version once confirmed. 2) Until patched, add a second authorization check outside the retriever, such as a direct FGA check per document and per user before content enters the prompt. 3) Where feasible, partition indexes or namespaces by tenant or permission group so unauthorized documents are never retrievable. 4) Log retrieved document IDs per request and compare them with FGA decisions to detect leaks. 5) Run test queries as low-privilege users against known restricted documents to verify the fix. 6) Consider restricting RAG access to highly sensitive corpora until the patch is validated.

How is it classified?

Auth BypassData LeakageData ExtractionRAGFrameworkPluginAML.T0036- Data from Information Repositories AML.T0057- LLM Data Leakage AML.T0085.000- RAG Databases

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Mechanisms to respond to and recover from AI risks

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM08-Vector and Embedding Weaknesses

Frequently Asked Questions

What is CVE-2026-108167?

Is CVE-2026-108167 actively exploited?

No confirmed active exploitation of CVE-2026-108167 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-108167?

1) Read the Okta advisory and upgrade auth0-ai-python and the auth0-ai-langchain and auth0-ai-llamaindex integrations to the fixed version once confirmed. 2) Until patched, add a second authorization check outside the retriever, such as a direct FGA check per document and per user before content enters the prompt. 3) Where feasible, partition indexes or namespaces by tenant or permission group so unauthorized documents are never retrievable. 4) Log retrieved document IDs per request and compare them with FGA decisions to detect leaks. 5) Run test queries as low-privilege users against known restricted documents to verify the fix. 6) Consider restricting RAG access to highly sensitive corpora until the patch is validated.

What systems are affected by CVE-2026-108167?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, agent frameworks, LLM application authorization layers, multi-tenant knowledge assistants.

What is the CVSS score for CVE-2026-108167?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesagent frameworksLLM application authorization layersmulti-tenant knowledge assistants

MITRE ATLAS Techniques

AML.T0036Data from Information Repositories

AML.T0057LLM Data Leakage

AML.T0085.000RAG Databases

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM08

What are the technical details?

Original Advisory

The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.

Exploitation Scenario

An employee with limited permissions uses an internal AI assistant backed by a RAG system that relies on the Auth0 FGA retriever. They ask questions about topics covered by restricted documents, such as executive compensation or pending legal matters. The retriever fails to correctly apply the FGA decision for their user and relation, so the denied documents are added to the model context. The LLM then summarizes or quotes them, handing the user confidential data without any visible authorization error and without alerting the security team.

Weaknesses (CWE)

CWE-863Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.