CVE-2026-121585: InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization
A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file internal/engine/infinity/sql.go of the component Text To SQL Retrieval. The manipulation of the argument tableName/kbIDs results in authorization bypass. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Event History
Frequently Asked Questions
Which deployments are affected?
InfiniFlow RAGFlow deployments up to version 0.27.2 and 1.0.0-rc2 are identified as affected, specifically the Text To SQL Retrieval component's RunSQL function in internal/engine/infinity/sql.go.
What access does an attacker need?
The issue can be exploited remotely, but the reported CVSS vector indicates that the attacker needs low-level privileges. Exploitation involves manipulating the tableName or kbIDs arguments.
Is exploit code available?
Yes. A public exploit has been released, so affected deployments should be considered at increased risk of attempted exploitation.