---
id: "CVE-2026-49951"
page: "https://infrastack.ai/live/CVE-2026-49951"
kind: "vulnerability"
aliases: ["CVE-2026-49951"]
title: "RAGFlow: unvalidated base_url lets authenticated users probe internal services"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "python", "ragflow", "self-hosted"]
not_affected_if: ["auth-required", "isolated-network"]
published_at: "2026-11-06T17:17:55+00:00"
first_seen_at: "2026-11-06T17:43:14+00:00"
updated_at: "2026-11-06T17:45:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49951", "first_seen_at": "2026-11-06T17:43:14+00:00"}]
exploit_sources: []
---

# RAGFlow: unvalidated base_url lets authenticated users probe internal services

Link for people: https://infrastack.ai/live/CVE-2026-49951 (this .md is for agents)

RAGFlow before 0.27.0 lets a logged-in user make the server send requests to any internal or external address by supplying a base_url to the set_api_key endpoint. Error text returned from those requests leaks details about internal services, open ports and configuration.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the RAGFlow version in use and whether it is below `0.27.0`
- Confirm whether the `/v1/llm/set_api_key` endpoint is reachable by users who hold an account

## Fix

- RAGFlow: move to `0.27.0` or later

## Timeline

- 2026-11-06T17:43:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-49951

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/ragflow-ssrf-via-set-api-key-base-url-parameter
- [fix] Patch: github.com https://github.com/infiniflow/ragflow/commit/b058229ab3a79cc2d61bc1724c2e120ce2ede46d

## From the sources

RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated base_url to the POST /v1/llm/set_api_key endpoint handled by set_api_key() in api/apps/llm_app.py. Attackers can exploit this flaw to probe shared-network services such as MySQL, Elasticsearch, Redis, MinIO, the Infinity vector database, and cloud metadata endpoints, with raw upstream exception text returned in the response leaking internal service details, open ports, and configuration fingerprints.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_