{"id":"CVE-2026-49951","kind":"vulnerability","aliases":["CVE-2026-49951"],"related":[],"title":"RAGFlow: unvalidated base_url lets authenticated users probe internal services","description":"RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated base_url to the POST /v1/llm/set_api_key endpoint handled by set_api_key() in api/apps/llm_app.py. Attackers can exploit this flaw to probe shared-network services such as MySQL, Elasticsearch, Redis, MinIO, the Infinity vector database, and cloud metadata endpoints, with raw upstream exception text returned in the response leaking internal service details, open ports, and configuration fingerprints.","summary":"RAGFlow before 0.27.0 lets a logged-in user make the server send requests to any internal or external address by supplying a base_url to the set_api_key endpoint. Error text returned from those requests leaks details about internal services, open ports and configuration.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","python","ragflow","self-hosted"],"not_affected_if":["auth-required","isolated-network"],"how_to_check":"- Check the RAGFlow version in use and whether it is below `0.27.0`\n- Confirm whether the `/v1/llm/set_api_key` endpoint is reachable by users who hold an account","fix":"- RAGFlow: move to `0.27.0` or later","status":"open","published_at":"2026-11-06T17:17:55+00:00","first_seen_at":"2026-11-06T17:43:14+00:00","triaged_at":"2026-11-06T17:45:18+00:00","updated_at":"2026-11-06T17:45:18+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-06T17:45:18Z","model":"claude-haiku-5-5","output":{"fix":"- RAGFlow: move to `0.27.0` or later","reach":"network","title":"RAGFlow: unvalidated base_url lets authenticated users probe internal services","impact":"medium","summary":"RAGFlow before 0.27.0 lets a logged-in user make the server send requests to any internal or external address by supplying a base_url to the set_api_key endpoint. Error text returned from those requests leaks details about internal services, open ports and configuration.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["ragflow","self-hosted","python"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"server probes internal services and leaks configuration details","analyst_note":"","how_to_check":"- Check the RAGFlow version in use and whether it is below `0.27.0`\n- Confirm whether the `/v1/llm/set_api_key` endpoint is reachable by users who hold an account","plain_action":"","needs_analyst":false,"not_affected_if":["auth-required","isolated-network"],"who_is_affected":"Self-hosted RAGFlow deployments before 0.27.0 where users have accounts. The server making outbound requests on users' behalf is the exposed part, so instances on networks with internal databases, caches or cloud metadata endpoints carry the most risk. Instances restricted to trusted users on isolated networks carry less.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000698,"input_tokens":4381,"output_tokens":520,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-49951':13A,16A '/v1/llm/set_api_key':108C '0.27.0':27B,73C 'address':44B 'ai':18B 'ai-tool':17B 'allow':83C 'api':53B,113C 'api/apps/llm_app.py':116C 'arbitrari':94C 'attack':85C,117C 'authent':6A,84C 'base':3A,48B,103C 'cloud':139C 'configur':70B,158C 'contain':74C 'cve':11A,14A 'databas':137C 'detail':63B,154C 'elasticsearch':131C 'endpoint':55B,98C,109C,141C 'error':56B 'except':145C 'exploit':119C 'extern':43B,97C 'fingerprint':159C 'flaw':121C 'forc':87C 'forgeri':80C 'handl':110C 'host':24B 'infin':135C 'intern':9A,41B,65B,95C,152C 'issu':91C 'key':54B,114C 'leak':62B,151C 'let':5A,28B 'log':31B 'logged-in':30B 'make':34B 'metadata':140C 'minio':133C 'mysql':130C 'network':126C 'open':67B,155C 'port':68B,156C 'post':107C 'probe':8A,123C 'python':20B 'ragflow':1A,21B,25B,71C 'raw':143C 'redi':132C 'request':38B,61B,79C,92C 'respons':150C 'return':58B,147C 'self':23B 'self-host':22B 'send':37B 'server':36B,77C,89C 'server-sid':76C 'servic':10A,66B,127C,153C 'set':52B,112C 'share':125C 'shared-network':124C 'side':78C 'suppli':46B,100C 'text':57B,146C 'tool':19B 'unvalid':2A,102C 'upstream':144C 'url':4A,49B,104C 'user':7A,33B 'vector':136C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted RAGFlow deployments before 0.27.0 where users have accounts. The server making outbound requests on users' behalf is the exposed part, so instances on networks with internal databases, caches or cloud metadata endpoints carry the most risk. Instances restricted to trusted users on isolated networks carry less.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","medium","python","ragflow","selfhosted"],"campaign_type":null,"search_a":"'-2026':12A,15A '-49951':13A,16A 'authent':6A 'base':3A 'cve':11A,14A 'intern':9A 'let':5A 'probe':8A 'ragflow':1A 'servic':10A 'unvalid':2A 'url':4A 'user':7A","search_b":"'0.27.0':27B 'address':44B 'ai':18B 'ai-tool':17B 'api':53B 'base':48B 'configur':70B 'detail':63B 'endpoint':55B 'error':56B 'extern':43B 'host':24B 'intern':41B,65B 'key':54B 'leak':62B 'let':28B 'log':31B 'logged-in':30B 'make':34B 'open':67B 'port':68B 'python':20B 'ragflow':21B,25B 'request':38B,61B 'return':58B 'self':23B 'self-host':22B 'send':37B 'server':36B 'servic':66B 'set':52B 'suppli':46B 'text':57B 'tool':19B 'url':49B 'user':33B","search_c":"'/v1/llm/set_api_key':108C '0.27.0':73C 'allow':83C 'api':113C 'api/apps/llm_app.py':116C 'arbitrari':94C 'attack':85C,117C 'authent':84C 'base':103C 'cloud':139C 'configur':158C 'contain':74C 'databas':137C 'detail':154C 'elasticsearch':131C 'endpoint':98C,109C,141C 'except':145C 'exploit':119C 'extern':97C 'fingerprint':159C 'flaw':121C 'forc':87C 'forgeri':80C 'handl':110C 'infin':135C 'intern':95C,152C 'issu':91C 'key':114C 'leak':151C 'metadata':140C 'minio':133C 'mysql':130C 'network':126C 'open':155C 'port':156C 'post':107C 'probe':123C 'ragflow':71C 'raw':143C 'redi':132C 'request':79C,92C 'respons':150C 'return':147C 'server':77C,89C 'server-sid':76C 'servic':127C,153C 'set':112C 'share':125C 'shared-network':124C 'side':78C 'suppli':100C 'text':146C 'unvalid':102C 'upstream':144C 'url':104C 'vector':136C 'vulner':81C","first_public_at":"2026-11-06T17:17:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-49951","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49951","severity":null,"published_at":"2026-11-06T17:17:55+00:00","modified_at":"2026-11-06T17:17:56+00:00","first_seen_at":"2026-11-06T17:43:14+00:00","fetched_at":"2026-11-06T17:43:14+00:00","note":null}],"documents":[{"id":88379,"url":"https://github.com/infiniflow/ragflow/commit/b058229ab3a79cc2d61bc1724c2e120ce2ede46d","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":88380,"url":"https://www.vulncheck.com/advisories/ragflow-ssrf-via-set-api-key-base-url-parameter","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}