{"id":"CVE-2026-108167","kind":"vulnerability","aliases":["CVE-2026-108167"],"related":[],"title":"Auth0 AI Python (LangChain, LlamaIndex): FGA retriever can pass denied documents into model context","description":"The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.","summary":"The auth0-ai-python FGA retriever does not separate authorization checks made for different users, relations or conditions during retrieval-augmented generation. Documents that Auth0 FGA denied can end up in the model context and in the generated answer.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"auth0-ai-langchain","fixed":["1.0.2"],"affected":"< 1.0.2","ecosystem":"pip"},{"name":"auth0-ai-llamaindex","fixed":["1.0.3"],"affected":"< 1.0.3","ecosystem":"pip"}],"ecosystems":[],"tags":["ai-tooling","auth0-ai-python","auth0-fga","langchain","llamaindex","python","rag"],"not_affected_if":["distinct-fga-object-per-document","no-fga-retriever"],"how_to_check":"Run pip show auth0-ai-langchain auth0-ai-llamaindex (or check requirements/poetry.lock). You are exposed if auth0-ai-langchain < 1.0.2 or auth0-ai-llamaindex < 1.0.3 AND your code uses FGARetriever where one retrieval returns several documents that map to the same FGA object but need different users, relations or contexts.","fix":"Upgrade auth0-ai-langchain to 1.0.2 or later and auth0-ai-llamaindex to 1.0.3 or later.","status":"open","published_at":"2026-11-10T21:17:53+00:00","first_seen_at":"2026-11-10T21:46:08+00:00","triaged_at":"2026-11-10T21:50:01+00:00","updated_at":"2026-11-10T21:51:22+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-11-10T21:50:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Auth0 AI Python: FGA retriever leaks denied documents into model context","impact":"medium","summary":"The auth0-ai-python FGA retriever does not separate authorization checks made for different users, relations or conditions during retrieval-augmented generation. Documents that Auth0 FGA denied can end up in the model context and in the generated answer.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["auth0-ai-python","python","rag","auth0-fga"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Users receive answers built from documents they are not authorized to see","analyst_note":"Find the affected and fixed auth0-ai-python versions in the NVD entry or the upstream GitHub advisory, and confirm the exposure conditions.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-fga-retriever"],"who_is_affected":"Applications that use the auth0-ai-python FGA retriever for retrieval-augmented generation with per-user document authorization. Systems that do not use this retriever, or that do not rely on Auth0 FGA for document filtering, are not described as affected. The sources do not give affected versions.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000699,"input_tokens":4527,"output_tokens":492,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the affected and fixed auth0-ai-python versions in the NVD entry or the upstream GitHub advisory, and confirm the exposure conditions.","search":"'-108167':17A,20A '-2026':16A,19A 'ai':2A,23A,27A,30B,34B,46B,87C 'ai-tool':29B 'answer':83B 'augment':65B,109C 'auth0':1A,22A,26A,33B,37B,45B,69B,86C,116C 'auth0-ai-langchain':21A 'auth0-ai-llamaindex':25A 'auth0-ai-python':32B,44B,85C 'auth0-fga':36B 'author':53B,95C 'check':54B,96C 'condit':61B,102C 'context':14A,78B,123C 'cve':15A,18A 'deni':10A,71B,114C 'differ':57B,98C 'distinguish':93C 'document':11A,67B,105C,113C 'end':73B 'fga':6A,38B,48B,70B,89C,117C 'filter':104C 'generat':66B,82B,110C,128C 'includ':119C 'langchain':4A,24A,39B 'llamaindex':5A,28A,40B 'made':55B 'model':13A,77B,122C 'pass':9A 'python':3A,35B,41B,47B,88C 'rag':42B 'relat':59B,100C 'respons':129C 'result':111C 'retriev':7A,49B,64B,90C,108C 'retrieval-aug':63B,107C 'separ':52B 'tool':31B 'use':125C 'user':58B,99C","nicknames":[],"mitigations":[],"who_affected":"Apps using the FGARetriever from auth0-ai-langchain or auth0-ai-llamaindex for RAG, when a single retrieval returns multiple documents that map to the same Auth0 FGA object but are checked under different users, relations or conditions. Documents FGA denied can then reach the model context and the answer. Apps that do not use the FGA retriever, or whose documents each map to a distinct object with one user and relation, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:51:22Z","by":"analyst","doc":"https://github.com/auth0/auth0-ai-python/security/advisories/GHSA-43rq-mx95-c3xx","run_id":2867},"products":{"at":"2026-11-10T21:51:22Z","by":"analyst","doc":"https://github.com/auth0/auth0-ai-python/security/advisories/GHSA-43rq-mx95-c3xx","run_id":2867},"how_to_check":{"at":"2026-11-10T21:51:22Z","by":"analyst","doc":"https://github.com/auth0/auth0-ai-python/security/advisories/GHSA-43rq-mx95-c3xx","run_id":2867},"who_affected":{"at":"2026-11-10T21:51:22Z","by":"analyst","doc":"https://github.com/auth0/auth0-ai-python/security/advisories/GHSA-43rq-mx95-c3xx","run_id":2867}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["auth0ailangchain","auth0aillamaindex"],"ptokens":["ai","auth0","langchain","llamaindex"],"labels":["aitooling","auth0aipython","auth0fga","langchain","llamaindex","medium","python","rag"],"campaign_type":null,"search_a":"'-108167':17A,20A '-2026':16A,19A 'ai':2A,23A,27A 'auth0':1A,22A,26A 'auth0-ai-langchain':21A 'auth0-ai-llamaindex':25A 'context':14A 'cve':15A,18A 'deni':10A 'document':11A 'fga':6A 'langchain':4A,24A 'llamaindex':5A,28A 'model':13A 'pass':9A 'python':3A 'retriev':7A","search_b":"'ai':30B,34B,46B 'ai-tool':29B 'answer':83B 'augment':65B 'auth0':33B,37B,45B,69B 'auth0-ai-python':32B,44B 'auth0-fga':36B 'author':53B 'check':54B 'condit':61B 'context':78B 'deni':71B 'differ':57B 'document':67B 'end':73B 'fga':38B,48B,70B 'generat':66B,82B 'langchain':39B 'llamaindex':40B 'made':55B 'model':77B 'python':35B,41B,47B 'rag':42B 'relat':59B 'retriev':49B,64B 'retrieval-aug':63B 'separ':52B 'tool':31B 'user':58B","search_c":"'ai':87C 'augment':109C 'auth0':86C,116C 'auth0-ai-python':85C 'author':95C 'check':96C 'condit':102C 'context':123C 'deni':114C 'differ':98C 'distinguish':93C 'document':105C,113C 'fga':89C,117C 'filter':104C 'generat':110C,128C 'includ':119C 'model':122C 'python':88C 'relat':100C 'respons':129C 'result':111C 'retriev':90C,108C 'retrieval-aug':107C 'use':125C 'user':99C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:17:53+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108167","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108167","severity":null,"published_at":"2026-11-10T21:17:53+00:00","modified_at":"2026-11-10T21:17:53+00:00","first_seen_at":"2026-11-10T21:46:08+00:00","fetched_at":"2026-11-10T21:46:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-108167:2867","url":"https://github.com/auth0/auth0-ai-python/security/advisories/GHSA-43rq-mx95-c3xx","severity":null,"published_at":"2026-11-10T21:51:22+00:00","modified_at":"2026-11-10T21:51:22+00:00","first_seen_at":"2026-11-10T21:51:22+00:00","fetched_at":"2026-11-10T21:51:22+00:00","note":"Read GHSA-43rq-mx95-c3xx (maintainer advisory): affected auth0-ai-langchain <1.0.2, auth0-ai-llamaindex <1.0.3; fixed in those. No exploitation/PoC found; skipped social search and code check (precondition needs judgement).","cites":["https://github.com/auth0/auth0-ai-python/security/advisories/GHSA-43rq-mx95-c3xx"]}],"documents":[{"id":119298,"url":"https://github.com/auth0/auth0-ai-python/security/advisories/GHSA-43rq-mx95-c3xx","title":"GHSA-43rq-mx95-c3xx: Improper Access Control in auth0-ai-python Document Retrieval","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}