Which versions of RAGFlow are affected by CVE-2025-69286?

RAGFlow deployments running versions earlier than 0.22.0 allow anyone holding an ordinary shared assistant or agent link to derive the owning user's personal API key, giving unauthenticated attackers…. A patch is available.

Is there a public PoC exploit available for CVE-2025-69286?

Yes, a public proof-of-concept exploit is available for CVE-2025-69286. Prioritise patching immediately. EPSS: 0.8%.

How to fix or mitigate CVE-2025-69286?

Within 24 hours, inventory every RAGFlow instance in the environment and determine which run versions below 0.22.0, then treat all personal API keys and outstanding assistant/agent share links on those instances as compromised: disable or restrict public sharing of assistants and agents where the platform permits, rotate API keys for all accounts that have created or distributed share links, and review access logs for unexpected API activity. Because publicly available exploit code exists (no confirmation of active exploitation / not in CISA KEV), prioritise internet-facing or partner-exposed instances first, and where immediate upgrade is impossible, take the shared-assistant feature offline or place the instance behind authentication and network restrictions as a stopgap. Within 7 days, upgrade all affected instances to RAGFlow 0.22.0 (vendor-released patch: 0.22.0), verify the upgrade completed and that sharing tokens are regenerated under the new scheme, and confirm that no legacy keys remain valid. Within 30 days, add RAGFlow to the standard patch-management and asset-inventory baseline so future releases are tracked, implement key-rotation and share-link expiry policies by default, and conduct a post-remediation review of logs from the exposure window to confirm no unauthorised account access or data exfiltration occurred, escalating to incident response if any is found.

RAGFlow CVE-2025-69286

Q: What is the CVSS score of CVE-2025-69286?

CVE-2025-69286 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

HIGH

Generation of Predictable Numbers or Identifiers (CWE-340)

2025-12-31 security-advisories@github.com

Authentication Bypass Python Ragflow

8.9

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Network-reachable, no auth, low complexity once the share URL (intended to be distributed) is held; deriving the API key yields full account control, so C/I/A all High and scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Metadata Corrected

Sep 23, 2026 - 14:40 vuln.today

tag: Python added

Analysis Generated

Sep 23, 2026 - 14:36 vuln.today

CVE Published

Dec 31, 2025 - 22:15 cve.org

HIGH 8.9

DescriptionCVE.org

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta (assistant/agent share auth) token generation process allows these tokens to be mutually derivable. Specifically, both tokens are generated using the same URLSafeTimedSerializer with predictable inputs, enabling an unauthorized user who obtains the shared assistant/agent URL to derive the personal API key. This grants them full control over the assistant/agent owner's account. Version 0.22.0 fixes the issue.

AnalysisAI

RAGFlow versions prior to 0.22.0 generate API keys and beta assistant/agent share tokens with a predictable scheme, letting anyone who holds a shared assistant or agent URL derive the owner's personal API key and take full control of their account. Exploitation is network-reachable and requires no authentication or user interaction (CVSS 4.0 8.9; independent CVSS 3.1 assessment AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), with the only practical prerequisite being a valid share link from an instance that exposes shared assistants. Publicly available exploit code exists (the GitHub security advisory GHSA-9j5g-g4xm-57w7 is referenced as an exploit source) and a vendor fix is available in 0.22.0, but there is no confirmation of active exploitation (not in CISA KEV) at time of analysis.

Technical ContextAI

The root cause is CWE-340 (Generation of Predictable Numbers or Identifiers) in the token generation helper of the RAGFlow API backend. Prior to 0.22.0, api/utils/api_utils.py implemented generate_confirmation_token(tenant_id) as a wrapper around itsdangerous URLSafeTimedSerializer(tenant_id), using the tenant identifier as both the serializer secret key and the salt before slicing serializer.dumps(get_uuid(), salt=tenant_id)[2:34]. Because the secret is not a random server-side value but a predictable per-tenant identifier, the function output is deterministic and reproducible by any party that knows the tenant_id. The beta share token in api/apps/system_app.py was produced by nesting the same function on itself - generate_confirmation_token(generate_confirmation_token(tenant_id)) - so the beta token embedded in a shared assistant/agent URL and the personal API key are both derived from the same low-entropy seed and are mutually derivable. The fix in commit a3bb4aadcc3494fb27f2a9933b4c46df8eb532e6 removes the tenant_id parameter entirely and replaces the whole scheme with cryptographically random secrets.token_urlsafe(32), dropping the URLSafeTimedSerializer import; the commit also touches api/apps/api_app.py (new_token) and rag/utils/redis_conn.py. The impact spans confidentiality, integrity and availability of the owner's account because the derived credential carries the owner's full API privileges.

RemediationAI

Upgrade to RAGFlow 0.22.0 or later, which replaces the predictable tenant_id-seeded URLSafeTimedSerializer with secrets.token_urlsafe(32); the upstream fix is commit a3bb4aadcc3494fb27f2a9933b4c46df8eb532e6 and the vendor advisory is https://github.com/infiniflow/ragflow/security/advisories/GHSA-9j5g-g4xm-57w7 (Vendor-released patch: 0.22.0). Because the token derivation is deterministic from the tenant_id, patched software alone is not sufficient if old tokens remain valid - after upgrading, rotate all API keys and regenerate every assistant/agent share link so previously derived or harvested values are invalidated, and audit logs for unexpected use of API keys belonging to share-link owners. If immediate upgrade is not possible, the most effective compensating control is to stop distributing assistant/agent share URLs outside the trust boundary (do not embed them in public pages, chat clients, or ticketing systems) and to revoke or regenerate existing shared links, which removes the attacker's required input; this has the operational trade-off of disabling the share feature for external users, and it is a mitigation rather than a fix because any link already leaked remains sufficient to derive the key. Restricting network reachability of the RAGFlow API (do not expose it directly to the internet; place it behind authenticated reverse proxy or VPN) reduces exposure but does not address the derivation itself if any authorized-but-lower-privileged user can obtain a share link. Note that API key rotation before patching provides only temporary relief, since the new key is generated by the same predictable function and remains derivable from the same tenant_id.