CVE-2026-121585 | InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2 Text To SQL Retrieval sql.go RunSQL tableName/kbIDs authorization (Issue 15123)

A vulnerability described as problematic has been identified in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file internal/engine/infinity/sql.go of the component Text To SQL Retrieval. The manipulation of the argument tableName/kbIDs results in authorization bypass.

This vulnerability was named CVE-2026-121585. The attack may be performed from remote. In addition, an exploit is available.VulDB Recent EntriesRead More