RAGFlow CVE-2026-121585

Exploitation requires a valid authenticated low-privilege account on the RAGFlow instance (CVSS PR:L) and that the Text-To-SQL Retrieval feature (the RunSQL / use_sql path) is in use. The attacker then supplies crafted tableName/kbIDs argument values that reference knowledge bases outside their own tenant, defeating the authorization check and enabling cross-tenant read access. Limiting factors that reduce realistic risk: an account is needed (not unauthenticated), the vulnerable retrieval feature must be reachable and in use, impact is read-only disclosure (no integrity/availability effect), and the issue is most consequential only in multi-tenant deployments running affected versions up to 0.27.2/1.0.0-rc2; single-tenant installs have little exposure.

Multiple signals agree this is a low-urgency issue despite being a genuine security flaw. The CVSS 4.0 base score is only 2.1 with vector AV:N/AC:L/AT:N/PR:L/UI:N and impact limited to VC:L (low confidentiality, no integrity or availability impact), and the vuln.today decision label is 'monitor' - not act_now or emergency. The exploit maturity metric E:P (Proof-of-Concept) is consistent with the public PoC reference (ZSH402/RAGFlow-Cross-Tenant-Read) but indicates no confirmed in-the-wild weaponization. There is no CISA KEV listing and no EPSS score was supplied, so widespread automated exploitation is not evidenced. The real-world concern is contextual rather than severity-driven: this is an authorization bypass (CWE-285) in a multi-tenant RAG product, so in shared/SaaS deployments a low-privilege tenant reading another tenant's knowledge-base data is a meaningful confidentiality breach even though the headline score is low. Net assessment: a real but low-priority issue for most single-tenant installs, elevated to a genuine priority only for multi-tenant deployments. Note a conflict to verify: the description locates the flaw in the Go file internal/engine/infinity/sql.go (RunSQL), yet the supplied fix PR #15124 adds a read-only SQL guard in Python (api/db/services/dialog_service.py) - the exact vulnerable code path should be confirmed with the vendor.

A registered low-privilege RAGFlow tenant user issues a Text-To-SQL retrieval request and manipulates the tableName/kbIDs arguments so the generated SQL references knowledge bases belonging to other tenants, bypassing the authorization/tenant-isolation check and reading cross-tenant data. The attack is remote over the network with low complexity but requires a valid authenticated account (PR:L). A public PoC reference exists (ZSH402/RAGFlow-Cross-Tenant-Read); it is not verified as working exploit code.