CVE-2026-75898 in RAGFlow
Summary
by MITRE • 08/18/2026
RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.py). The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or requests.put without calling the shared assert_url_is_safe validator or pinning the resolved address, unlike the crawler, SearXNG, file-upload, and RSS fetch paths. A user who can create or trigger an agent can direct the server to fetch loopback, link-local, and RFC 1918 destinations, including cloud instance metadata endpoints and services co-located on the deployment network, and the response body is returned as the component output. Where an agent is configured to interpolate the chat query into the Invoke URL, the destination is chosen by whoever can send that query.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in RAGFlow versions prior to 0.26.3 constitutes a critical server-side request forgery flaw located within the agent workflow's "Invoke" component, specifically in the file agent/component/invoke.py. This security defect arises from an inconsistent implementation of input validation and URL sanitization protocols compared to other components within the same application ecosystem. While dedicated modules such as the crawler, SearXNG integration, file-upload handler, and RSS fetch mechanism correctly employ a shared assert_url_is_safe validator or enforce strict address pinning mechanisms, the Invoke component bypasses these essential safeguards. Instead of validating the integrity and safety of the outbound request URL, the component constructs the target URI dynamically using canvas configuration parameters combined with runtime template variables. This constructed URL is then passed directly to standard HTTP client methods including requests.get, requests.post, or requests.put without any intermediate security checks, creating a direct pathway for malicious actors to manipulate server-side network behavior.
The operational impact of this vulnerability allows an authenticated user who possesses the ability to create or trigger agent workflows to force the RAGFlow server into making arbitrary outbound HTTP requests. By manipulating the template variables and canvas configurations, attackers can craft URLs that target internal infrastructure resources rather than external public services. This capability enables the exfiltration of sensitive data from loopback interfaces, link-local addresses, and private RFC 1918 network ranges. A particularly severe consequence is the potential access to cloud instance metadata endpoints, which often contain authentication tokens, IAM roles, and other credentials necessary for further lateral movement within a compromised environment. Furthermore, because the response body of these forged requests is returned directly as the component output, attackers can perform blind or semi-blind data exfiltration, retrieving sensitive information from services co-located on the deployment network that would otherwise be inaccessible to external users.
The severity of this vulnerability is significantly amplified when agents are configured to interpolate chat queries into the Invoke URL parameters. In such configurations, the destination address becomes directly dependent on user input provided during interaction with the application. This transforms a static configuration flaw into a dynamic attack vector where any individual capable of sending a query can dictate which internal or external resource the server contacts. This level of control facilitates not only data theft but also potential network reconnaissance and pivoting opportunities, allowing attackers to map out the internal network topology by observing response codes and content variations from different target addresses. The lack of address pinning means that even if DNS rebinding attacks are attempted, the server may resolve malicious domains to private IP ranges at runtime, further expanding the attack surface beyond simple static URL manipulation.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), specifically reflecting weaknesses in input validation and outbound request handling. It also maps to MITRE ATT&CK techniques related to Network Service Discovery and Data Exfiltration via Command and Control channels, as the attacker leverages legitimate application functionality to probe internal networks and extract data. To mitigate this risk, immediate remediation involves updating RAGFlow to version 0.26.3 or later where these validation gaps have been addressed. In environments where upgrading is not immediately feasible, administrators should implement network-level controls such as egress filtering rules that restrict outbound connections from the application server to only known and necessary external domains while blocking access to private IP ranges and cloud metadata endpoints. Additionally, deploying a web application firewall with SSRF detection capabilities can provide an additional layer of defense by inspecting outgoing requests for patterns indicative of internal resource targeting or suspicious URL structures before they reach the vulnerable component.