AI Threat AlertCVE-2026-119337: RAGFlow: missing authz lets users run others' agents
HIGHRAGFlow versions 0.25.2 through 0.27.2 have a missing authorization check (CWE-862) in the OpenAI-compatible agent chat endpoint, so any authenticated user who knows another user's private agent UUID can run that agent and read its output across user or tenant boundaries. The flaw is rated high (CVSS 7.1) with network reach, low complexity and only low privileges required, and it matters most for multi-tenant or shared RAGFlow deployments where agents are wired to private knowledge bases or internal tools. No public exploit, Nuclei template or KEV listing exists and EPSS is not yet available, so there is no sign of active exploitation, but exploitation is trivial once an agent UUID is obtained. Upgrade to RAGFlow 0.27.3 now, and until you can, restrict access to the chat completions API and review logs for calls to agents the caller does not own.
What is the risk?
High but not urgent. Exploitation needs a valid account and knowledge of a target agent UUID, which is a random identifier that is hard to guess but can leak through shared links, logs, browser history or exports. Confidentiality impact is high because agent output can expose private knowledge base content, and integrity impact is low because configured tools may cause side effects. The vendor states that stronger impacts were not demonstrated. No KEV listing, public exploit or scanner template is known, and EPSS data is unavailable. Exposure is greatest where self-registration is open or many tenants share one instance.
How does the attack unfold?
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade RAGFlow to 0.27.3 or later, which moves the accessible() check before the OpenAI-compatible branch (see commit 20180790 and PR 19817). 2) Until patched, block or restrict POST /api/v1/agents/chat/completions at the reverse proxy for untrusted users, and disable open self-registration. 3) Audit access logs for calls to this endpoint with agent IDs not belonging to the caller. 4) Rotate any credentials or API keys embedded in agent tools if suspicious cross-user calls are found. 5) Apply least privilege to tools and data sources attached to agents so cross-boundary execution has limited blast radius. 6) Treat agent UUIDs as sensitive and avoid sharing them in tickets, chats or logs.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-119337?
RAGFlow versions 0.25.2 through 0.27.2 have a missing authorization check (CWE-862) in the OpenAI-compatible agent chat endpoint, so any authenticated user who knows another user's private agent UUID can run that agent and read its output across user or tenant boundaries. The flaw is rated high (CVSS 7.1) with network reach, low complexity and only low privileges required, and it matters most for multi-tenant or shared RAGFlow deployments where agents are wired to private knowledge bases or internal tools. No public exploit, Nuclei template or KEV listing exists and EPSS is not yet available, so there is no sign of active exploitation, but exploitation is trivial once an agent UUID is obtained. Upgrade to RAGFlow 0.27.3 now, and until you can, restrict access to the chat completions API and review logs for calls to agents the caller does not own.
Is CVE-2026-119337 actively exploited?
No confirmed active exploitation of CVE-2026-119337 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-119337?
1) Upgrade RAGFlow to 0.27.3 or later, which moves the accessible() check before the OpenAI-compatible branch (see commit 20180790 and PR 19817). 2) Until patched, block or restrict POST /api/v1/agents/chat/completions at the reverse proxy for untrusted users, and disable open self-registration. 3) Audit access logs for calls to this endpoint with agent IDs not belonging to the caller. 4) Rotate any credentials or API keys embedded in agent tools if suspicious cross-user calls are found. 5) Apply least privilege to tools and data sources attached to agents so cross-boundary execution has limited blast radius. 6) Treat agent UUIDs as sensitive and avoid sharing them in tickets, chats or logs.
What systems are affected by CVE-2026-119337?
This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, agent frameworks, multi-tenant LLM platforms, OpenAI-compatible API gateways.
What is the CVSS score for CVE-2026-119337?
CVE-2026-119337 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.34%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0012Valid AccountsAML.T0049Exploit Public-Facing ApplicationAML.T0053AI Agent Tool InvocationAML.T0085.000RAG DatabasesCompliance Controls Affected
What are the technical details?
Original Advisory
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. From 0.25.2 until 0.27.3, POST /api/v1/agents/chat/completions invokes completion_openai and returns through the openai-compatible branch before UserCanvasService.accessible() checks whether the caller may access the requested agent. An authenticated user who knows another user's private agent UUID can execute that Only me workflow and read its output across the user or tenant boundary; configured tools may also cause side effects, but stronger impacts were not demonstrated. This issue is fixed in version 0.27.3.
Exploitation Scenario
An attacker registers or uses a low-privilege account on a shared RAGFlow instance and obtains the UUID of a colleague's private agent from a shared link, a log excerpt or a leaked export. They send a POST to /api/v1/agents/chat/completions with that agent ID in the OpenAI-compatible format. The request skips the ownership check, so the private agent runs its workflow, queries its internal knowledge base and returns the results. The attacker repeats this with crafted questions to extract confidential documents, and may trigger configured tools such as email or webhook actions as a side effect.
Weaknesses (CWE)
CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
- [Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
- [Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:NReferences
Timeline
Related Vulnerabilities
CVE-2025-512010.0smolagents: sandbox escape enables unauthenticated RCE
Same attack type: Data LeakageCVE-2023-376510.0MLflow: path traversal allows arbitrary file read
Same attack type: Data LeakageCVE-2025-282810.0LangChain RequestsToolkit: SSRF exposes cloud metadata
Same attack type: Auth BypassCVE-2025-5376710.0Azure OpenAI: SSRF EoP, no auth required (CVSS 10)
Same attack type: Auth BypassCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same attack type: Auth Bypass