CVE-2026-75898 infiniflow CVE debrief

Who should care

Defenders who manage RAGFlow deployments, especially those where agents can be created or triggered by users, should assess their exposure to this vulnerability and prioritize verification and remediation efforts.

Why it matters

CVE-2026-75898 is a high-severity SSRF vulnerability in RAGFlow that allows attackers to direct the server to fetch arbitrary destinations, potentially leading to sensitive information exposure, service disruption, and security risks. Defenders should prioritize verifying exposure, especially in environments where agents can be created or triggered by users, and implement additional security measures to detect and prevent SSRF attacks.

• Potential SSRF attacks on cloud instance metadata endpoints and services co-located on the deployment network.
• Possible exposure of sensitive information through response body output.
• Potential disruption of services due to arbitrary destination fetching.
• Verification of RAGFlow version and configuration to ensure mitigation.

Technical summary

The vulnerability is caused by the lack of validation in the 'Invoke' component of the RAGFlow project. The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or requests.put without calling the shared assert_url_is_safe validator or pinning the resolved address. This allows an attacker to direct the server to fetch loopback, link-local, and RFC 1918 destinations, including cloud instance metadata endpoints and services co-located on the deployment network. The response body is returned as the component output, potentially leading to sensitive information exposure. Users who can create or trigger an agent can exploit R

Defensive priority

Defenders should prioritize verifying exposure to this vulnerability, especially in environments where agents can be created or triggered by users. They should also assess the impact of potential SSRF attacks on their systems and networks.

Recommended defensive actions

• Verify if the RAGFlow version is 0.26.3 or later.
• Restrict the ability to create or trigger agents to trusted users.
• Implement additional security measures to detect and prevent SSRF attacks.
• Review network configurations to restrict access to sensitive services.
• Monitor for suspicious activity related to agent workflows.
• Perform regular security audits to identify potential vulnerabilities.
• Update documentation to reflect changes in security posture.

Evidence notes

The evidence for this vulnerability comes from the official CVE Program record and the NIST National Vulnerability Database. Additional details are provided by source references from [email protected], including GitHub commits and issues related to the RAGFlow project.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.