LLM frameworks · InfiniFlow
RAGFlow
Open-source RAG engine with agent workflows, used to build chat assistants and agents on top of your own documents.
3Advisories
0critical
2high
1medium
2026-11-06Latest
Timeline · advisories per quarter
32026 Q4
Named in sources
Reported for RAGFlow
01. CVE-2026-119337: RAGFlow's OpenAI-compatible endpoint lets any user run another user's private agent, upgrade to 0.27.3From 0.25.2 until 0.27.3, RAGFlow's POST /api/v1/agents/chat/completions returned through its OpenAI-compatible branch before checking whether the caller may use the agent. Any logged-in user who knows the UUID of someone else's 'Only me' agent can run it and read its output across user or tenant boundaries. RAGFlow 2026-10-30 02. CVE-2026-51893 and CVE-2026-51897: RAGFlow 0.24.0 lets any logged-in user open other users' mindmap tasks and evaluation datasetsTwo missing ownership checks in RAGFlow 0.24.0. The trace_mindmap handler in api/apps/kb_app.py and the get_dataset handler in api/apps/evaluation_app.py take a caller-supplied task or dataset id and return it without checking that it belongs to the caller's user or tenant. RAGFlow 2026-10-01 03. CVE-2026-49951: RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrarRAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated base_url to the POST /v1/llm/set_api_key endpoint handled by set_api_key() in… RAGFlow 2026-11-06
RAGFlow 2026-10-30 02. CVE-2026-51893 and CVE-2026-51897: RAGFlow 0.24.0 lets any logged-in user open other users' mindmap tasks and evaluation datasetsTwo missing ownership checks in RAGFlow 0.24.0. The trace_mindmap handler in api/apps/kb_app.py and the get_dataset handler in api/apps/evaluation_app.py take a caller-supplied task or dataset id and return it without checking that it belongs to the caller's user or tenant. RAGFlow 2026-10-01 03. CVE-2026-49951: RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrarRAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated base_url to the POST /v1/llm/set_api_key endpoint handled by set_api_key() in… RAGFlow 2026-11-06