RAGFlow before version 0.27.0 is vulnerable to a server‑side request forgery (SSRF) that permits authenticated attackers to supply an unvalidated base_url to the POST /v1/llm/set_api_key endpoint. By doing so the software will issue outgoing HTTP requests to any target specified in the base_url. The application returns the raw exception text from these requests, which can reveal open ports, service fingerprints, and configuration information for internal components such as MySQL, Elasticsearch, Redis, MinIO, the Infinity vector database, and cloud metadata endpoints.

The vulnerability affects the Infiniflow RAGFlow product, specifically all releases earlier than version 0.27.0. Versions 0.27.0 and later contain the fix demonstrated in the 0.27.0 release notes.

The CVSS score of 5.3 indicates a moderate risk. EPSS data is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting that CI may not be widely exploited yet. The attack requires authentication to the RAGFlow API, which limits its applicability to users who can log in to the application. An attacker can use the flaw to probe internal services and gather reconnaissance data, potentially facilitating further attacks within the internal network. The direct impact is primarily disclosure of internal service information rather than remote code execution.