CVE-2026-75898: RAGFlow SSRF Vulnerability in Agent

CVE-2026-75898 Overview

CVE-2026-75898 is a Server-Side Request Forgery (SSRF) vulnerability in RAGFlow versions prior to 0.26.3. The flaw resides in the agent workflow Invoke component located at agent/component/invoke.py. The component constructs outbound HTTP requests from canvas configuration and runtime template variables, then passes the URL to requests.get, requests.post, or requests.put without validating the destination through the shared assert_url_is_safe guard. Any user who can create or trigger an agent can redirect server requests to internal destinations. This vulnerability is categorized under [CWE-918].

Critical Impact
Attackers can force the RAGFlow server to reach loopback, link-local, and RFC 1918 destinations, including cloud instance metadata endpoints, and receive the response body as component output.

Affected Products

RAGFlow versions prior to 0.26.3
RAGFlow v0.26.2 (confirmed vulnerable)
Deployments exposing the agent workflow Invoke component to authenticated users

Discovery Timeline

2026-08-18 - CVE-2026-75898 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-75898

Vulnerability Analysis

The Invoke component in RAGFlow provides agents with the ability to call arbitrary HTTP endpoints during workflow execution. The component reads a URL from canvas configuration and interpolates runtime template variables into it before issuing the request. Unlike the crawler, SearXNG, file-upload, and RSS fetch paths in RAGFlow, the Invoke component omits any call to the shared assert_url_is_safe validator and does not pin the resolved address to prevent DNS rebinding.

The response body from the outbound request is returned verbatim as the component output. This allows an attacker to exfiltrate the contents of internal services through the agent response channel. Where an agent is configured to interpolate the user chat query into the Invoke URL, the destination is chosen by whoever can send that query, extending the attack surface to any user with chat access.

Root Cause

The root cause is missing URL validation before invoking requests.get, requests.post, or requests.put in agent/component/invoke.py. RAGFlow maintains a shared SSRF guard (common.ssrf_guard) that other network-fetching components use, but the Invoke component bypasses this control. The absence of address pinning also permits time-of-check to time-of-use DNS rebinding attacks.

Attack Vector

An authenticated user with agent creation or trigger privileges configures an Invoke component pointing at an internal address. Common targets include http://169.254.169.254/latest/meta-data/ for AWS instance metadata, http://127.0.0.1 loopback services, and RFC 1918 hosts co-located on the deployment network. When the agent runs, the server issues the request and returns the response body to the caller.

python

# Security patch in agent/component/invoke.py
# Source: https://github.com/infiniflow/ragflow/commit/c4fe68eaa0bf1d6442d2cd6ac2e35bc9ccbed34f

 from agent.component.base import ComponentBase, ComponentParamBase
 from common.connection_utils import timeout
+from common.ssrf_guard import assert_url_is_safe, pin_dns
 from deepdoc.parser import HtmlParser

The patch imports the shared assert_url_is_safe and pin_dns helpers, bringing the Invoke component in line with the validation applied elsewhere in the codebase.

Detection Methods for CVE-2026-75898

Indicators of Compromise

Outbound HTTP requests from the RAGFlow server to 169.254.169.254, 127.0.0.1, ::1, or RFC 1918 ranges originating from agent workflows
Unexpected access to cloud instance metadata endpoints in application logs
Agent execution logs containing internal hostnames or private IP addresses in Invoke component URL fields
Anomalous chat queries containing URL fragments or template injection targeting the Invoke node

Detection Strategies

Inspect RAGFlow agent canvas definitions for Invoke components whose URL fields reference private address space or interpolate user input
Monitor egress traffic from RAGFlow hosts for connections to link-local and loopback destinations
Alert on any HTTP 200 responses from 169.254.169.254 in host-level or VPC flow logs where the source is a RAGFlow container

Monitoring Recommendations

Centralize RAGFlow application and access logs to correlate agent triggers with outbound connection attempts
Enable cloud provider metadata service audit logging (IMDSv2 with hop limit for AWS) and alert on unauthorized retrievals
Track version banners on RAGFlow deployments and flag hosts still running < 0.26.3

How to Mitigate CVE-2026-75898

Immediate Actions Required

Upgrade RAGFlow to version 0.26.3 or later, which introduces the assert_url_is_safe and pin_dns guards in the Invoke component
Enforce IMDSv2 with a hop limit of 1 on cloud instances hosting RAGFlow to reduce exposure of instance metadata
Restrict agent creation and trigger permissions to trusted users pending patch deployment
Audit existing agent canvases for Invoke components pointing at internal addresses or interpolating unsanitized user input

Patch Information

The fix is delivered in the RAGFlow v0.26.3 release. See the commits c4fe68e - Harden closed-advisory fixes and e16d1a0 - fix(agent): add SSRF guard to Invoke HTTP component. Additional context is available in the VulnCheck Security Advisory.

Workarounds

Place the RAGFlow server behind an egress proxy that denies traffic to loopback, link-local, and RFC 1918 destinations
Deny access to 169.254.169.254 at the network layer for the RAGFlow workload
Disable or remove the Invoke component from available agent canvas nodes until the upgrade can be applied

bash

# Example egress restriction using iptables to block metadata service
iptables -A OUTPUT -d 169.254.169.254 -m owner --uid-owner ragflow -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 -m owner --uid-owner ragflow -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner ragflow -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner ragflow -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner ragflow -j REJECT