# CVE-2026-119337: RAGFlow authorization bypass in OpenAI-compatible agent completion

Source: https://junglewise.ai/threats/cve-2026-119337-ragflow-is-an-open-source-rag-retrieval-augmented-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119337 · Severity: high · CVSS 7.1 · Published 2026-10-30

RAGFlow is an open-source retrieval-augmented generation engine used to build AI agents. An authenticated user can bypass access controls to invoke private agents belonging to other users or tenants by directly calling the OpenAI-compatible completion API with another user's agent UUID. This allows reading agent output and potentially triggering configured tool side effects without proper authorization.

Technologies: [InfiniFlow RAGFlow](https://junglewise.ai/threats/technologies/ragflow). Vendors: [InfiniFlow](https://junglewise.ai/threats/vendors/infiniflow).

## Quick answers

**Is CVE-2026-119337 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119337 being exploited in the wild.

**How severe is CVE-2026-119337?** High severity, with a CVSS score of 7.1, published 30 October 2026.

**Which products and versions are affected?** InfiniFlow RAGFlow 0.25.2 to 0.27.2.

**Is there a fix for CVE-2026-119337?** Yes: fixed in 0.27.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119337 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-119337?** Check whether you run InfiniFlow RAGFlow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.27.3

## Technical details

The vulnerability is an authorization bypass in the POST /api/v1/agents/chat/completions endpoint where the OpenAI-compatible code path invokes completion_openai and returns before the UserCanvasService.accessible() check is performed. An authenticated attacker can craft a request with a known private agent UUID to access workflows they should not have permission to execute. The fix moves the authorization check before the early return in the OpenAI-compatible branch so both code paths enforce the same access control.

## Affected products

- InfiniFlow RAGFlow 0.25.2 to 0.27.2

## Timeline

- 2026-10-30: disclosed
- 2026-09-18: patched

## References

- [https://github.com/infiniflow/ragflow/commit/20180790e1a8c55553a2f3e75718f3d65178ae6d](https://github.com/infiniflow/ragflow/commit/20180790e1a8c55553a2f3e75718f3d65178ae6d)
- [https://github.com/infiniflow/ragflow/pull/19817](https://github.com/infiniflow/ragflow/pull/19817)

## Related threats

- [RAGFlow server-side request forgery in LLM API key endpoint](https://junglewise.ai/threats/cve-2026-49951-ragflow-before-0-27-0-contains-a-server-side-request-forgery)
- [InfiniFlow RAGFlow server-side request forgery in Seafile Connector](https://junglewise.ai/threats/cve-2026-121927-a-vulnerability-has-been-found-in-infiniflow-ragflow-up-to-0-27)
- [InfiniFlow RAGFlow authorization bypass in Text To SQL Retrieval](https://junglewise.ai/threats/cve-2026-121585-a-security-flaw-has-been-discovered-in-infiniflow-ragflow-up-to)
- [RAGFlow improper access control in get_dataset API endpoint](https://junglewise.ai/threats/cve-2026-51897-ragflow-0-24-0-contains-improper-access-control-in-get-dataset)
- [infiniflow RAGFlow improper access control in resume API](https://junglewise.ai/threats/cve-2026-51896-infiniflow-ragflow-0-25-3-contains-improper-access-control-in)