---
id: "CVE-2026-108167"
page: "https://infrastack.ai/live/CVE-2026-108167"
kind: "vulnerability"
aliases: ["CVE-2026-108167"]
title: "Auth0 AI Python (LangChain, LlamaIndex): FGA retriever can pass denied documents into model context"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "auth0-ai-langchain", "fixed": ["1.0.2"], "affected": "< 1.0.2", "ecosystem": "pip"}, {"name": "auth0-ai-llamaindex", "fixed": ["1.0.3"], "affected": "< 1.0.3", "ecosystem": "pip"}]
ecosystems: []
tags: ["ai-tooling", "auth0-ai-python", "auth0-fga", "langchain", "llamaindex", "python", "rag"]
not_affected_if: ["distinct-fga-object-per-document", "no-fga-retriever"]
published_at: "2026-11-10T21:17:53+00:00"
first_seen_at: "2026-11-10T21:46:08+00:00"
updated_at: "2026-11-10T21:51:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108167", "first_seen_at": "2026-11-10T21:46:08+00:00"}, {"source": "analyst", "url": "https://github.com/auth0/auth0-ai-python/security/advisories/GHSA-43rq-mx95-c3xx", "first_seen_at": "2026-11-10T21:51:22+00:00", "cites": ["https://github.com/auth0/auth0-ai-python/security/advisories/GHSA-43rq-mx95-c3xx"]}]
exploit_sources: []
---

# Auth0 AI Python (LangChain, LlamaIndex): FGA retriever can pass denied documents into model context

Link for people: https://infrastack.ai/live/CVE-2026-108167 (this .md is for agents)

The auth0-ai-python FGA retriever does not separate authorization checks made for different users, relations or conditions during retrieval-augmented generation. Documents that Auth0 FGA denied can end up in the model context and in the generated answer.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pip:auth0-ai-langchain affected < 1.0.2 fixed 1.0.2
- pip:auth0-ai-llamaindex affected < 1.0.3 fixed 1.0.3

## How to check

Run pip show auth0-ai-langchain auth0-ai-llamaindex (or check requirements/poetry.lock). You are exposed if auth0-ai-langchain < 1.0.2 or auth0-ai-llamaindex < 1.0.3 AND your code uses FGARetriever where one retrieval returns several documents that map to the same FGA object but need different users, relations or contexts.

## Fix

Upgrade auth0-ai-langchain to 1.0.2 or later and auth0-ai-llamaindex to 1.0.3 or later.

## Timeline

- 2026-11-10T21:46:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108167
- 2026-11-10T21:51:22+00:00 analyst https://github.com/auth0/auth0-ai-python/security/advisories/GHSA-43rq-mx95-c3xx — Read GHSA-43rq-mx95-c3xx (maintainer advisory): affected auth0-ai-langchain <1.0.2, auth0-ai-llamaindex <1.0.3; fixed in those. No exploitation/PoC found; skipped social search and code check (precondition needs judgement).

## Documents

- [advisory] GHSA-43rq-mx95-c3xx: Improper Access Control in auth0-ai-python Document Retrieval https://github.com/auth0/auth0-ai-python/security/advisories/GHSA-43rq-mx95-c3xx

## From the sources

The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_