CVE-2026-49951: RAGFlow < 0.27.0 SSRF via set_api_key base_url Parameter

Q: Who can exploit this issue?

An attacker must be authenticated and able to call the POST /v1/llm/set_api_key endpoint. The issue affects RAGFlow versions before 0.27.0.

Q: What systems could be exposed through a successful exploit?

The vulnerable server can be induced to send requests to arbitrary internal or external endpoints. This can be used to probe services on a shared network, including MySQL, Elasticsearch, Redis, MinIO, the Infinity vector database, and cloud metadata endpoints.

Q: What information can the attacker obtain from the response?

Raw upstream exception text is returned in the response. This may disclose internal service details, open ports, and configuration fingerprints.

Q: How can I determine whether my deployment is affected?

Check whether the deployed RAGFlow version is earlier than 0.27.0 and whether authenticated users can access POST /v1/llm/set_api_key. Affected instances accept an unvalidated base_url parameter through this endpoint.

Published Nov 6, 2026

Updated

RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated baseurl to the POST /v1/llm/setapikey endpoint handled by setapikey() in api/apps/llmapp.py. Attackers can exploit this flaw to probe shared-network services such as MySQL, Elasticsearch, Redis, MinIO, the Infinity vector database, and cloud metadata endpoints, with raw upstream exception text returned in the response leaking internal service details, open ports, and configuration fingerprints.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade RAGFlow to a version that resolves this vulnerability.
Fixed in 0.27.0

Event History

Nov 6, 2026

CVE Published

via MITRE·04:09 PM

Data Sourced

via MITRE·04:09 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated and able to call the POST /v1/llm/set_api_key endpoint. The issue affects RAGFlow versions before 0.27.0.

What systems could be exposed through a successful exploit?

The vulnerable server can be induced to send requests to arbitrary internal or external endpoints. This can be used to probe services on a shared network, including MySQL, Elasticsearch, Redis, MinIO, the Infinity vector database, and cloud metadata endpoints.

What information can the attacker obtain from the response?

Raw upstream exception text is returned in the response. This may disclose internal service details, open ports, and configuration fingerprints.

How can I determine whether my deployment is affected?

Check whether the deployed RAGFlow version is earlier than 0.27.0 and whether authenticated users can access POST /v1/llm/set_api_key. Affected instances accept an unvalidated base_url parameter through this endpoint.

CVE-2026-49951: RAGFlow < 0.27.0 SSRF via set_api_key base_url Parameter

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What systems could be exposed through a successful exploit?

What information can the attacker obtain from the response?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What systems could be exposed through a successful exploit?

What information can the attacker obtain from the response?

How can I determine whether my deployment is affected?