CVE-2026-6587: RAGAS Collections Module SSRF Vulnerability

CVE-2026-6587 Overview

A Server-Side Request Forgery (SSRF) vulnerability has been discovered in vibrantlabsai RAGAS up to version 0.4.3. The vulnerability exists in the _try_process_local_file and _try_process_url functions within the file src/ragas/metrics/collections/multi_modal_faithfulness/util.py of the Collections Module. By manipulating the retrieved_contexts argument, an attacker can exploit this vulnerability to make the server perform unauthorized requests to internal or external resources. The exploit has been publicly released and may be used in active attacks. Notably, a previous security patch for CVE-2025-45691 was applied to a different module, leaving this vulnerability unaddressed.

Critical Impact

Remote attackers with low privileges can exploit this SSRF vulnerability to access internal services, potentially leading to data exfiltration, internal network reconnaissance, or chained attacks against internal infrastructure.

Affected Products

• vibrantlabsai RAGAS up to version 0.4.3
• RAGAS Collections Module (multi_modal_faithfulness)
• Systems using _try_process_local_file and _try_process_url functions

Discovery Timeline

• April 20, 2026 - CVE-2026-6587 published to NVD
• April 22, 2026 - Last updated in NVD database

Technical Details for CVE-2026-6587

Vulnerability Analysis

This vulnerability is classified as Server-Side Request Forgery (CWE-918), occurring in the RAGAS framework's multi-modal faithfulness evaluation component. The vulnerable functions _try_process_local_file and _try_process_url in the Collections Module fail to properly validate and sanitize user-supplied input in the retrieved_contexts parameter before processing URLs or file paths.

When processing multimodal content for faithfulness evaluation, the application accepts context data that may include URLs or file references. The lack of proper validation allows an attacker to craft malicious inputs that force the server to make requests to arbitrary internal or external endpoints. This can be exploited to probe internal network infrastructure, access cloud metadata services, or interact with internal APIs that should not be externally accessible.

The vendor was contacted about this vulnerability but did not respond, and the previous patch for CVE-2025-45691 only addressed a different module, leaving this attack surface exposed.

Root Cause

The root cause stems from insufficient input validation in the URL and file processing functions within the util.py file of the Collections Module. The _try_process_local_file and _try_process_url functions accept the retrieved_contexts argument without implementing proper allowlist validation, URL scheme restrictions, or network boundary checks. This allows attacker-controlled input to influence server-side HTTP requests and file system access operations.

Attack Vector

The attack can be initiated remotely by an authenticated attacker with low privileges. By providing a crafted payload in the retrieved_contexts parameter, an attacker can direct the server to:

1. Access internal services on localhost or private IP ranges (e.g., http://127.0.0.1/admin, http://169.254.169.254/latest/meta-data/)
2. Probe internal network hosts and ports for reconnaissance
3. Retrieve sensitive files from the local file system through the _try_process_local_file function
4. Potentially bypass firewall restrictions by leveraging the server as a proxy

The vulnerability requires network access and user authentication but does not require user interaction, making it suitable for automated exploitation. Technical details and proof-of-concept information are available in the Adithya Nak Vulnerability Report.

Detection Methods for CVE-2026-6587

Indicators of Compromise

• Unusual outbound HTTP requests from servers running RAGAS to internal IP addresses (127.0.0.1, 10.x.x.x, 172.16-31.x.x, 192.168.x.x)
• Requests to cloud metadata endpoints (169.254.169.254) from RAGAS application processes
• Log entries showing access to the multi_modal_faithfulness module with suspicious URL patterns in retrieved_contexts
• Unexpected file access patterns in the RAGAS application working directory

Detection Strategies

• Monitor and alert on outbound requests from RAGAS instances to internal network ranges or localhost addresses
• Implement web application firewall (WAF) rules to detect SSRF patterns in API requests targeting RAGAS endpoints
• Review application logs for unusual URL schemes (file://, gopher://, dict://) in multimodal evaluation requests
• Deploy network segmentation monitoring to detect lateral movement attempts originating from RAGAS servers

Monitoring Recommendations

• Enable verbose logging for the RAGAS Collections Module to capture all URL processing attempts
• Configure egress filtering alerts for RAGAS application servers attempting connections to non-approved destinations
• Implement anomaly detection for API calls to the multimodal faithfulness evaluation endpoints
• Monitor for DNS queries from RAGAS servers to internal hostnames or suspicious external domains

How to Mitigate CVE-2026-6587

Immediate Actions Required

• Restrict network access for RAGAS application servers to only necessary external endpoints using egress firewall rules
• Implement input validation at the application boundary to reject internal IP addresses and sensitive URL schemes
• Consider disabling or restricting access to the multimodal faithfulness evaluation feature until a patch is available
• Deploy a reverse proxy or WAF with SSRF protection capabilities in front of RAGAS instances

Patch Information

As of the last NVD update on April 22, 2026, no official patch has been released by the vendor. The vendor was contacted about this disclosure but did not respond. The previous security patch for CVE-2025-45691 addressed a different module and does not mitigate this vulnerability. Organizations should monitor the VulDB entry and vendor channels for patch announcements.

Workarounds

• Implement allowlist-based URL validation for all inputs to the retrieved_contexts parameter, permitting only trusted external domains
• Block outbound requests to internal IP ranges (RFC 1918), link-local addresses (169.254.x.x), and localhost from the RAGAS application
• Use network segmentation to isolate RAGAS servers from sensitive internal services and cloud metadata endpoints
• Consider forking the repository and applying custom input validation to src/ragas/metrics/collections/multi_modal_faithfulness/util.py

# Example iptables rules to restrict RAGAS server egress
# Block access to internal networks and cloud metadata
iptables -A OUTPUT -d 127.0.0.0/8 -m owner --uid-owner ragas -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner ragas -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner ragas -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner ragas -j DROP
iptables -A OUTPUT -d 169.254.169.254/32 -m owner --uid-owner ragas -j DROP