CVE-2026-75898: RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component
RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.py). The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or requests.put without calling the shared asserturlissafe validator or pinning the resolved address, unlike the crawler, SearXNG, file-upload, and RSS fetch paths. A user who can create or trigger an agent can direct the server to fetch loopback, link-local, and RFC 1918 destinations, including cloud instance metadata endpoints and services co-located on the deployment network, and the response body is returned as the component output. Where an agent is configured to interpolate the chat query into the Invoke URL, the destination is chosen by whoever can send that query.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RAGFlowto a version that resolves this vulnerability.Fixed in 0.26.3 - Configuration
Modify the Invoke component to call the shared assert_url_is_safe validator on the constructed outbound URL and pin/validate the resolved address before using requests.get/requests.post/requests.put.
RAGFlow agent workflow "Invoke" (agent/component/invoke.py) Use shared assert_url_is_safe validator and pin resolved address = enabled
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments are exposed if they run a version before 0.26.3 and allow a user to create or trigger an agent using the Invoke component. The impact is greatest where the RAGFlow server can reach internal services, loopback or link-local addresses, RFC 1918 networks, or cloud metadata endpoints.
What access does an attacker need to exploit this?
An attacker needs the ability to create or trigger an agent. If an Invoke URL interpolates the chat query, anyone able to submit that query can choose the request destination.
What can be done if patching is not immediately possible?
Upgrade to version 0.26.3 or later. If upgrading is not immediately possible, restrict creation and triggering of agents that use Invoke, and prevent the RAGFlow server from reaching loopback, link-local, private-network, and metadata-service destinations through network controls.
How can I identify potentially affected agent workflows?
Review agent workflows for the Invoke component, especially configurations whose URL is built from canvas settings or runtime template variables. An affected workflow can cause server-originated GET, POST, or PUT requests and return the fetched response body as component output.