CVE-2026-121585

EUVD-2026-116597
A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file internal/engine/infinity/sql.go of the component Text To SQL Retrieval. The manipulation of the argument tableName/kbIDs results in authorization bypass. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulDBCNA
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 15.7%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
infiniflowragflow
0.27.0
CNA
infiniflowragflow
0.27.1
CNA
infiniflowragflow
0.27.2
CNA
Common Weakness Enumeration
References
https://github.com/ZSH402/RAGFlow-Cross-Tenant-Read
https://github.com/infiniflow/ragflow/
https://github.com/infiniflow/ragflow/issues/15123
https://github.com/infiniflow/ragflow/pull/15124
https://vuldb.com/cve/CVE-2026-121585
https://vuldb.com/submit/1020561
https://vuldb.com/vuln/430429
https://vuldb.com/vuln/430429/cti