CVE-2026-121585 — Vulnerability intelligence
—
Published:
- CVSS
- 2.1
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file internal/engine/infinity/sql.go of the component Text To SQL Retrieval. The manipulation of the argument tableName/kbIDs results in authorization bypass. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.