Description

RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.py). The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or requests.put without calling the shared assert_url_is_safe validator or pinning the resolved address, unlike the crawler, SearXNG, file-upload, and RSS fetch paths. A user who can create or trigger an agent can direct the server to fetch loopback, link-local, and RFC 1918 destinations, including cloud instance metadata endpoints and services co-located on the deployment network, and the response body is returned as the component output. Where an agent is configured to interpolate the chat query into the Invoke URL, the destination is chosen by whoever can send that query.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-18T15:17:15.367Z",
  "pubdate": "2026-08-18T15:17:15.367Z",
  "executiveSummary": "A server-side request forgery (SSRF) vulnerability exists in RAGFlow before version 0.26.3, specifically within the agent workflow \"Invoke\" component located at agent/component/invoke.py.\nThis vulnerability allows an authenticated or unauthenticated user capable of creating, configuring, or triggering an agent workflow to force the RAGFlow server to issue arbitrary outbound HTTP requests using methods such as requests.get, requests.post, or requests.put.\nThe primary impact involves unauthorized access to internal network resources, including loopback addresses, link-local scopes, RFC 1918 private address spaces, sensitive cloud instance metadata endpoints, and internal co-located services.\nBecause the vulnerability design returns the fetched response body directly as the component output, sensitive data exfiltration is achieved immediately upon successful execution.\nFurthermore, when agents are configured to dynamically interpolate chat queries directly into the Invoke URL, external attackers sending specially crafted queries can dictate the target destination.\nThe risk implication is critical, as internal infrastructure becomes exposed to external actors through the application layer without requiring complex privilege escalation vectors.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate input validation and the omission of safety controls within the agent workflow \"Invoke\" component. Unlike other functional modules in the application such as the crawler, SearXNG, file-upload, and RSS fetch paths which properly invoke the shared assert_url_is_safe validator and pin resolved IP addresses, agent/component/invoke.py fails to implement these defensive mechanisms.\nThe vulnerable component constructs outbound request URLs dynamically by combining canvas configurations with runtime template variables. These constructed URLs are subsequently passed directly to Python requests library functions (requests.get, requests.post, or requests.put) without prior verification of the target destination address.\nAttack flow begins when an actor creates, configures, or triggers an agent containing the vulnerable Invoke component. The attacker supplies malicious input via canvas parameters, runtime template variables, or direct chat queries if the workflow interpolates the chat query into the Invoke URL.\nUpon triggering the workflow, the RAGFlow server resolves and requests the attacker-specified destination. This includes prohibited internal endpoints such as 127.0.0.1, 169.254.169.254 for cloud metadata, or internal microservices on RFC 1918 networks.\nThe internal service processes the request and returns the response to the RAGFlow server, which captures the response body and exposes it back to the user as the component execution output, facilitating direct data exfiltration.\nThe affected product is RAGFlow in versions prior to 0.26.3, specifically impacting the file agent/component/invoke.py.\nExploitation requirements include the ability to create or trigger an agent workflow, or supply chat queries where user input is mapped directly to the Invoke component URL parameters."
}