---
id: CVE-2026-121585
title: InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization
summary: >-
  A security flaw has been discovered in InfiniFlow RAGFlow up to
  0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file
  internal/engine/infinity/sql.go of the component Text To SQL Retrieval. The
  manipulation of the argument table…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-639
  - CWE-285
vendor: InfiniFlow
product: RAGFlow
affected:
  - RAGFlow 0.27.0
  - RAGFlow 0.27.1
  - RAGFlow 0.27.2
  - RAGFlow 1.0.0-rc1
  - RAGFlow 1.0.0-rc2
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T23:30:17.239Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121585'
references:
  - url: 'https://vuldb.com/vuln/430429'
    label: >-
      VDB-430429 | InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL
      authorization
  - url: 'https://vuldb.com/vuln/430429/cti'
    label: 'VDB-430429 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-121585'
    label: CVE-2026-121585 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1020561'
    label: 'Submit #1020561 | InfiniFlow RAGFlow 1.0.0-rc1 Authorization Bypass'
  - url: 'https://github.com/infiniflow/ragflow/issues/15123'
  - url: 'https://github.com/infiniflow/ragflow/pull/15124'
  - url: 'https://github.com/ZSH402/RAGFlow-Cross-Tenant-Read'
  - url: 'https://github.com/infiniflow/ragflow/'
tags:
  - cve.org
epss: 0.00244
epssPercentile: 0.15703
ingestedAt: '2026-11-05T20:33:06.613Z'
---

## Overview

A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file internal/engine/infinity/sql.go of the component Text To SQL Retrieval. The manipulation of the argument tableName/kbIDs results in authorization bypass. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

## Affected

- `RAGFlow 0.27.0`
- `RAGFlow 0.27.1`
- `RAGFlow 0.27.2`
- `RAGFlow 1.0.0-rc1`
- `RAGFlow 1.0.0-rc2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.