{"id":"CVE-2026-121585","kind":"vulnerability","aliases":["CVE-2026-121585"],"related":[],"title":"RAGFlow: Text-to-SQL retrieval flaw lets remote users bypass authorization","description":"A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file internal/engine/infinity/sql.go of the component Text To SQL Retrieval. The manipulation of the argument tableName/kbIDs results in authorization bypass. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.","summary":"RAGFlow, an open-source retrieval-augmented generation platform, has a flaw in its Text-to-SQL retrieval code where manipulated tableName or kbIDs arguments bypass authorization. An attacker who can reach the service may read knowledge-base data they should not be able to access.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ragflow","fixed":[],"affected":"<= 0.27.2, <= 1.0.0-rc2","ecosystem":"vendor"}],"ecosystems":[],"tags":["ai-tooling","infinity","rag","ragflow","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"Check your RAGFlow version (<= 0.27.2 or 1.0.0-rc2 is in the affected range). Check whether DOC_ENGINE is infinity in docker/.env and whether non-admin users or open sign-up (REGISTER_ENABLED) can reach the instance. Fixed version is not published in any source I found.","fix":null,"status":"open","published_at":"2026-11-04T00:17:26+00:00","first_seen_at":"2026-11-04T00:46:17+00:00","triaged_at":"2026-11-04T00:48:03+00:00","updated_at":"2026-11-04T00:49:22+00:00","category":"ai-tooling","confidence":0.5,"triage":{"at":"2026-11-04T00:48:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"RAGFlow: Text-to-SQL retrieval flaw lets remote users bypass authorization","impact":"medium","summary":"RAGFlow, an open-source retrieval-augmented generation platform, has a flaw in its Text-to-SQL retrieval code where manipulated tableName or kbIDs arguments bypass authorization. An attacker who can reach the service may read knowledge-base data they should not be able to access.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["ragflow","self-hosted","rag","infinity"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads knowledge-base data across tables without authorization","analyst_note":"Check the upstream RAGFlow advisory or commit for the fixed version and whether authentication is required; the NVD entry gives only the affected range and CVSS 4.3.","how_to_check":"- Confirm the installed RAGFlow version, for example by checking the release tag or image version in your deployment.\n- Check whether the Text-to-SQL retrieval feature is enabled and reachable from untrusted networks.","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running self-hosted RAGFlow at versions up to 0.27.2 or 1.0.0-rc2 where the Text-to-SQL retrieval path is reachable. The sources do not say which deployment settings enable the vulnerable path, and they do not name a fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000709,"input_tokens":4173,"output_tokens":584,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Check the upstream RAGFlow advisory or commit for the fixed version and whether authentication is required; the NVD entry gives only the affected range and CVSS 4.3.","search":"'-121585':15A,18A '-2026':14A,17A '/1.0.0-rc2':90C '0.27.2':89C 'abl':75B 'access':77B 'ai':21B 'ai-tool':20B 'argument':55B,111C 'attack':59B,118C,137C 'augment':36B 'author':12A,57B,115C 'base':69B 'bypass':11A,56B,116C 'code':49B 'compon':102C 'cve':13A,16A 'data':70B 'discov':83C 'exploit':125C 'file':98C 'flaw':7A,41B,80C 'function':94C 'generat':37B 'host':28B 'impact':92C 'infin':23B 'infiniflow':85C 'internal/engine/infinity/sql.go':99C 'kbid':54B 'knowledg':68B 'knowledge-bas':67B 'let':8A 'manipul':51B,108C 'may':65B,119C,133C 'open':32B 'open-sourc':31B 'perform':121C 'platform':38B 'public':131C 'rag':24B 'ragflow':1A,19A,25B,29B,86C 'reach':62B 'read':66B 'releas':128C 'remot':9A,123C 'result':113C 'retriev':6A,35B,48B,106C 'retrieval-aug':34B 'runsql':95C 'secur':79C 'self':27B 'self-host':26B 'servic':64B 'sourc':33B 'sql':5A,47B,105C 'tablenam':52B 'tablename/kbids':112C 'text':3A,45B,103C 'text-to-sql':2A,44B 'tool':22B 'use':135C 'user':10A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted RAGFlow up to 0.27.2 or 1.0.0-rc2 using the Infinity document engine (the flaw is in the Infinity engine's RunSQL, Text-to-SQL retrieval). The CVSS vector indicates a low-privilege account is needed, so the risk is a signed-in user reading knowledge bases they should not see. Instances with Elasticsearch as the engine or no untrusted users can likely skip it, but no vendor source confirms this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ragflow"],"ptokens":["ragflow"],"labels":["aitooling","infinity","medium","rag","ragflow","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121585","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121585","severity":null,"published_at":"2026-11-04T00:17:26+00:00","modified_at":"2026-11-04T00:17:27+00:00","first_seen_at":"2026-11-04T00:46:17+00:00","fetched_at":"2026-11-04T00:46:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121585:1590","url":null,"severity":null,"published_at":"2026-11-04T00:49:22+00:00","modified_at":"2026-11-04T00:49:22+00:00","first_seen_at":"2026-11-04T00:49:22+00:00","fetched_at":"2026-11-04T00:49:22+00:00","note":"No RAGFlow advisory, issue or commit for this CVE found (searched GitHub advisories, issues, VulDB, web). Only NVD (linked). CNA vector has PR:L, so a low-privilege account is likely needed, not unauthenticated; that comes from the vector, not the vendor. Fixed version unknown. rc3 (Oct 30, 2026) exists but no source ties it to this CVE. Nothing verified. To settle: upstream issue/PR touching internal/engine/infinity/sql.go RunSQL."}],"documents":[{"id":62152,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121585","title":"NVD CVE-2026-121585","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}