Read the docs
TI-2026-85988 Aliases CVE-2026-49951GHSA-ghwm-jvhv-h9gp

RAGFlow set_api_key SSRF lets attackers probe internal services

Priority LOW 24CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

RAGFlow before 0.27.0 contains a server-side request forgery flaw that lets authenticated attackers make the server send requests to arbitrary internal or external endpoints by supplying an unvalidated base_url to the set_api_key endpoint. An attacker with a valid account can use this to probe shared-network services such as MySQL, Redis and cloud metadata endpoints, and raw upstream exception text in the response leaks internal service details. The flaw is tracked as CWE-918.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated base_url to the POST /v1/llm/set_api_key endpoint handled by set_api_key() in api/apps/llm_app.py. Attackers can exploit this flaw to probe shared-network services such as MySQL, Elasticsearch, Redis, MinIO, the Infinity vector database, and cloud metadata endpoints, with raw upstream exception text returned in the response leaking internal service details, open ports, and configuration fingerprints.

Why it matters now

EPSS 0.00252 16th percentileScored 2026-11-07
Fix Fixed ragflow (infiniflow): 0.27.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
infiniflowragflowbefore 0.27.00.27.0Patch availableCNA
  • ragflow Vendorinfiniflow Affected before 0.27.0 Fixed in 0.27.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:infiniflow:ragflow:*:*:*:*:*:*:*:*——infiniflow
  • cpe:2.3:a:infiniflow:ragflow:*:*:*:*:*:*:*:* Versions — — ·infiniflow

Remediation

Upgrade infiniflow RAGFlow to version 0.27.0, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA ragflow (infiniflow) Fixed in 0.27.0

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-49951
  2. 2026-11-06 Alias added: GHSA-ghwm-jvhv-h9gp

References

Patch 2

Other 1

  • TI-2026-19971 RAGFlow Affected by Zip Slip Remote Code Execution (RCE) in MinerUParser CVSS 3.1CRITICAL 9.8
  • TI-2025-30545 Missing brute-force protection in infiniflow RAGFlow CVSS 3.1CRITICAL 9.8
  • TI-2024-11535 Remote Code Execution in infiniflow/ragflow CVSS 3.0CRITICAL 9.8
  • TI-2025-42731 RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability CVSS 4.0HIGH 8.9
  • TI-2025-19992 RAGFlow SQL Injection vulnerability CVSS 4.0HIGH 8.9
  • TI-2026-33111 RAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution CVSS 3.1CRITICAL 9.9
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences