CVE-2026-6587 vibrantlabsai CVE debrief

Who should care

Security teams and administrators responsible for vibrantlabsai RAGAS up to 0.4.3 should be aware of this server-side request forgery vulnerability. The vulnerability can be exploited remotely, and an exploit has been publicly released. Therefore, immediate attention is required to assess the vulnerability's impact and apply necessary patches or mitigations.

Technical summary

The vulnerability, CVE-2026-6587, is a server-side request forgery (SSRF) issue in the vibrantlabsai RAGAS up to version 0.4.3. It is located in the Collections Module, specifically in the functions _try_process_local_file and _try_process_url within the file src/ragas/metrics/collections/multi_modal_faithfulness/util.py. An attacker can manipulate the retrieved_contexts argument to exploit this vulnerability, allowing for SSRF attacks that can be initiated remotely. The exploit has been made public, increasing the urgency for affected systems to apply patches or appropriate mitigations.

Defensive priority

Given the low CVSS score of 2.1 and the fact that the exploit has been publicly released, defenders should prioritize patching or mitigating this vulnerability. Although the CVSS severity is rated as LOW, the remote exploitability and public availability of an exploit make it a priority for security teams to address.

Recommended defensive actions

• Assess the vulnerability's impact on your systems and prioritize patching or mitigation efforts.
• Apply the security patch for CVE-2026-6587 as soon as possible.
• Implement compensating controls to detect and prevent SSRF attacks.
• Monitor systems for suspicious activity related to the Collections Module.
• Verify that the vendor's remediation workflow is followed for vulnerable systems.

Evidence notes

The CVE-2026-6587 record and associated details are based on information from various sources, including the National Vulnerability Database (NVD) and other security advisories. The vulnerability affects vibrantlabsai RAGAS up to version 0.4.3 and is classified under CWE-918, Server-Side Request Forgery. The vendor, vibrantlabsai, was contacted but did not respond.

Official resources