---
id: "CVE-2026-121585"
kind: "vulnerability"
aliases: ["CVE-2026-121585"]
title: "RAGFlow: Text-to-SQL retrieval flaw lets remote users bypass authorization"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "ragflow", "fixed": [], "affected": "<= 0.27.2, <= 1.0.0-rc2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ai-tooling", "infinity", "rag", "ragflow", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2026-11-04T00:17:26+00:00"
first_seen_at: "2026-11-04T00:46:17+00:00"
updated_at: "2026-11-04T00:49:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121585", "first_seen_at": "2026-11-04T00:46:17+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T00:49:22+00:00"}]
---

# RAGFlow: Text-to-SQL retrieval flaw lets remote users bypass authorization

RAGFlow, an open-source retrieval-augmented generation platform, has a flaw in its Text-to-SQL retrieval code where manipulated tableName or kbIDs arguments bypass authorization. An attacker who can reach the service may read knowledge-base data they should not be able to access.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ragflow affected <= 0.27.2, <= 1.0.0-rc2 fixed ?

## How to check

Check your RAGFlow version (<= 0.27.2 or 1.0.0-rc2 is in the affected range). Check whether DOC_ENGINE is infinity in docker/.env and whether non-admin users or open sign-up (REGISTER_ENABLED) can reach the instance. Fixed version is not published in any source I found.

## Timeline

- 2026-11-04T00:46:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121585
- 2026-11-04T00:49:22+00:00 analyst — No RAGFlow advisory, issue or commit for this CVE found (searched GitHub advisories, issues, VulDB, web). Only NVD (linked). CNA vector has PR:L, so a low-privilege account is likely needed, not unauthenticated; that comes from the vector, not the vendor. Fixed version unknown. rc3 (Oct 30, 2026) exists but no source ties it to this CVE. Nothing verified. To settle: upstream issue/PR touching internal/engine/infinity/sql.go RunSQL.

## Documents

- [describes] NVD CVE-2026-121585 https://nvd.nist.gov/vuln/detail/CVE-2026-121585

## From the sources

A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file internal/engine/infinity/sql.go of the component Text To SQL Retrieval. The manipulation of the argument tableName/kbIDs results in authorization bypass. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_