A server‑side request forgery flaw exists in RAGFlow versions prior to 0.26.3. The agent workflow component that builds outbound HTTP requests does so using user‑controlled data without validating the target URL or pinning the resolved address. When an attacker can create or trigger an agent, they can instruct the server to request arbitrary loopback, link‑local, or RFC 1918 addresses, including cloud metadata services, and the response is returned to the attacker. This flaw is classified as CWE‑918 and can lead to disclosure of internal network information or compromise of services running on the same host.

infiniflow:ragflow, all releases before v0.26.3. Users running any older RAGFlow build on their infrastructure are affected; the vulnerability exists in the agent/Invoke component. The CPE identifies the product as cpe:2.3:a:infiniflow:ragflow:*:*:*:*:*:*:*:*.

The CVSS score of 8.4 indicates high severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV. Since the flaw requires the ability to create or trigger an agent, the attack vector is likely local or authenticated, though it could be exploited remotely if an attacker gains sufficient privileges to instantiate an agent. The flaw allows an attacker to probe internal services and retrieve their responses, potentially exposing sensitive data or enabling further attacks.