PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6587 vibrantlabsai CVE debrief

A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function _try_process_local_file/_try_process_url of the file src/ragas/metrics/collections/multi_modal_faithfulness/util.py of the component Collections Module. Performing a manipulation of the argument retrieved_contexts results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The security patch for CVE-2025-45691 was applied to a different module only. The vendor was contacted early about this disclosure but did not respond in any way.

Vendor
vibrantlabsai
Product
RAGAS
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-20
Original CVE updated
2026-07-15
Advisory published
2026-04-20
Advisory updated
2026-07-15

Who should care

Security teams and administrators responsible for vibrantlabsai RAGAS up to 0.4.3 should be aware of this server-side request forgery vulnerability. The vulnerability can be exploited remotely, and an exploit has been publicly released. Therefore, immediate attention is required to assess the vulnerability's impact and apply necessary patches or mitigations.

Technical summary

The vulnerability, CVE-2026-6587, is a server-side request forgery (SSRF) issue in the vibrantlabsai RAGAS up to version 0.4.3. It is located in the Collections Module, specifically in the functions _try_process_local_file and _try_process_url within the file src/ragas/metrics/collections/multi_modal_faithfulness/util.py. An attacker can manipulate the retrieved_contexts argument to exploit this vulnerability, allowing for SSRF attacks that can be initiated remotely. The exploit has been made public, increasing the urgency for affected systems to apply patches or appropriate mitigations.

Defensive priority

Given the low CVSS score of 2.1 and the fact that the exploit has been publicly released, defenders should prioritize patching or mitigating this vulnerability. Although the CVSS severity is rated as LOW, the remote exploitability and public availability of an exploit make it a priority for security teams to address.

Recommended defensive actions

  • Assess the vulnerability's impact on your systems and prioritize patching or mitigation efforts.
  • Apply the security patch for CVE-2026-6587 as soon as possible.
  • Implement compensating controls to detect and prevent SSRF attacks.
  • Monitor systems for suspicious activity related to the Collections Module.
  • Verify that the vendor's remediation workflow is followed for vulnerable systems.

Evidence notes

The CVE-2026-6587 record and associated details are based on information from various sources, including the National Vulnerability Database (NVD) and other security advisories. The vulnerability affects vibrantlabsai RAGAS up to version 0.4.3 and is classified under CWE-918, Server-Side Request Forgery. The vendor, vibrantlabsai, was contacted but did not respond.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-6587 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-6587

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-6587 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-6587

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.