RAGFlow CVE-2026-75898

Exploitation requires a valid account on the RAGFlow instance with permission to create, modify, or trigger agent workflows - a low-privilege but authenticated condition (PR:L per CVSS). For the highest-impact path targeting cloud instance metadata endpoints, no special non-default product configuration is required beyond the use of the Invoke component in an agent workflow, which is a standard product capability. When an agent is configured to interpolate chat query content into the Invoke URL, the effective attacker pool expands to any user authorized to send chat queries to that agent, not just users with workflow editing rights. Exploitation is constrained by the network reachability of internal target destinations from the RAGFlow server process, and by IMDSv2 enforcement on cloud platforms - AWS EC2 IMDSv2 requires a PUT-based token exchange that blocks naive single-hop SSRF against the metadata endpoint, raising the practical barrier on hardened cloud deployments.

The CVSS 4.0 score of 8.4 reflects a network-accessible, low-complexity exploit requiring only low-privilege authentication (PR:L), with high confidentiality impact on both the vulnerable system (VC:H) and subsequent systems (SC:H), accurately capturing the risk of cloud credential theft via instance metadata endpoints and enumeration of co-located internal services. No EPSS data was supplied and the vulnerability does not appear in the CISA KEV catalog, so mass exploitation has not been confirmed by any authoritative source. However, two public patch commits on GitHub clearly identify the missing validation call, making the exploit mechanism straightforward to reconstruct - even a mid-sized deployment team in walbrzych running RAGFlow on a cloud-hosted VM should treat this as urgent, given the near-zero complexity required to reach AWS or GCP metadata endpoints once a low-privilege account is available. The gap between low-privilege authenticated access (PR:L) and high downstream confidentiality impact on co-located internal infrastructure (SC:H) makes this a genuine operational priority rather than a theoretical high-score edge case.

An authenticated low-privilege RAGFlow user accesses an agent whose Invoke component URL is configured to interpolate user-supplied chat query content into the destination field. The user sends a chat query containing an internal target such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ and the RAGFlow server issues the HTTP request without validation, returning the cloud IAM role's temporary credentials in the agent output. Two public patch commits on GitHub clearly identify the missing assert_url_is_safe call, making the vulnerable code path straightforward to reconstruct for any reviewer examining the diff.