RAGFlow private agents were not private through the OpenAI-compatible endpoint
A private agent setting should follow the agent into every execution interface. RAGFlow had a path where it did not. The October 5, 2026 advisory GHSA-c6q8-23rp-32cv describes an authenticated user who can run another user's Only me agent by knowing its UUID and sending it to POST /api/v1/agents/chat/completions with "openai-compatible": true.
The endpoint matters because it imitates an OpenAI-compatible completion API. A client that uses that interface may treat the agent ID as a model identifier. The normal agent UI may enforce a permission check, while the compatibility route reaches the same execution engine through a different request path. The advisory states that the private-agent check was skipped and that the caller could read the output.
An agent can contain prompts, retrieval settings, connected data sources, and tools. Running another user's agent can disclose its output, trigger billable model calls, or cause side effects in connected systems. The vulnerability requires authentication and knowledge of an agent UUID. It does not require the caller to be an owner or a member of the same workspace.
The advisory identifies versions 0.25.2 through 0.27.2 as affected in available reporting. The GitHub advisory page checked for this article did not identify a fixed release. That uncertainty should be carried into response planning. An operator should verify the current vendor release and test the endpoint rather than assuming that an upgrade exists or that an old workaround is sufficient.
Remove alternate authorization paths
Review every route that can execute an agent, including webhooks, OpenAI-compatible completions, API keys, and scheduled jobs. Resolve the agent ID and the caller before execution, then apply the same ownership and workspace check used by the primary interface. A UUID is an identifier, not an authorization token.
If the endpoint is not required, disable it at the reverse proxy and in application configuration. If it must remain, require explicit permission for the compatibility route and log the caller, agent ID, workspace, and outcome. Do not log full prompts or retrieved documents.
Restrict access to the RAGFlow management network while the vendor position is unclear. Rotate API keys that may have been issued to broad automation accounts. Review model-provider spend and tool activity for unexpected agent executions. A missing error in the UI is not proof that the backend rejected the request.
Build an authorization test for each route. User A should receive a denial when invoking User B's private agent, and the denial should occur before model invocation or tool execution. Repeat the test with an API key and with the OpenAI-compatible flag. A sound design returns the same decision regardless of the protocol wrapper.
