EUVD-2026-60824
GHSA-9m4v-54qq-67fw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible SSRF exploitable by any authenticated user (PR:L); scope change (S:C) reflects high confidentiality impact on reachable internal and cloud metadata systems.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.py). The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or requests.put without calling the shared assert_url_is_safe validator or pinning the resolved address, unlike the crawler, SearXNG, file-upload, and RSS fetch paths. A user who can create or trigger an agent can direct the server to fetch loopback, link-local, and RFC 1918 destinations, including cloud instance metadata endpoints and services co-located on the deployment network, and the response body is returned as the component output. Where an agent is configured to interpolate the chat query into the Invoke URL, the destination is chosen by whoever can send that query.
AnalysisAI
Server-side request forgery in RAGFlow before v0.26.3 allows authenticated users who can create or trigger agent workflows to direct the server to make HTTP requests to arbitrary internal destinations, including RFC 1918 addresses, loopback interfaces, link-local ranges, and cloud instance metadata endpoints. The vulnerable 'Invoke' component in agent/component/invoke.py bypasses the shared assert_url_is_safe validator consistently applied in other fetch paths (crawler, SearXNG, file-upload, RSS), and returns the fetched response body directly to the caller. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid account on the RAGFlow instance with permission to create, modify, or trigger agent workflows - a low-privilege but authenticated condition (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.4 reflects a network-accessible, low-complexity exploit requiring only low-privilege authentication (PR:L), with high confidentiality impact on both the vulnerable system (VC:H) and subsequent systems (SC:H), accurately capturing the risk of cloud credential theft via instance metadata endpoints and enumeration of co-located internal services. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated low-privilege RAGFlow user accesses an agent whose Invoke component URL is configured to interpolate user-supplied chat query content into the destination field. The user sends a chat query containing an internal target such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ and the RAGFlow server issues the HTTP request without validation, returning the cloud IAM role's temporary credentials in the agent output. … |
| Remediation | Upgrade to RAGFlow v0.26.3 or later, released July 2, 2026, which addresses this vulnerability via commits e16d1a0150e1ca069beb538ae3dcd03f59edc5fa and c4fe68eaa0bf1d6442d2cd6ac2e35bc9ccbed34f (see https://github.com/infiniflow/ragflow/releases/tag/v0.26.3). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all RAGFlow instances, confirm versions, and restrict agent workflow creation permissions to a minimal set of trusted administrators. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. Rated critical severity (CVSS 9
Path traversal vulnerability in RAGFlow RAG engine version 0.23.1 allows unauthenticated attackers to read arbitrary fil
In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities.
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Rated high severity (CVSS 8.9), this vulnerabilit
The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulne
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. Rated high s
A Server-Side Request Forgery (SSRF) vulnerability exists in infiniflow/ragflow version 0.12.0. Rated high severity (CVS
RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents
A vulnerability in infiniflow/ragflow version RAGFlow-0.13.0 allows for partial account takeover via insecure data query
Server-side template injection in RAGFlow 0.24.0 and earlier allows any authenticated user to execute arbitrary operatin
An XSS vulnerability in infiniflow/ragflow version 0.12.0 allows an attacker to upload a malicious PDF file to the knowl
Stored XSS in RAGFlow before 0.26.3 enables cross-user JavaScript execution through unsanitized agent pipeline node name
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today