Access Control Vulnerability in RAGFlow Open-Source Engine

CVE-2026-119337

What is CVE-2026-119337?

RAGFlow, an open-source Retrieval-Augmented Generation engine, has a vulnerability that allows authenticated users to access another user's private agents without authorization. Specifically, from versions 0.25.2 to 0.27.3, a flaw in the API allows users who know the UUID of a private agent to execute workflows and read the output, breaching user and tenant boundaries. This raises serious concerns about user privacy and data exposure, as unauthorized access to sensitive information can occur. The issue has been resolved in version 0.27.3.

References