RAGFlow: unvalidated base_url in set_api_key lets authenticated users make server-side requests

Impact

Any RAGFlow user who is logged in can give the set_api_key endpoint an arbitrary base_url, and the RAGFlow server will send requests to it. The server's raw exception text comes back in the response, so the attacker can map the services sitting next to RAGFlow: MySQL, Elasticsearch, Redis, MinIO, the Infinity vector database and cloud metadata endpoints. On a GPU node or cluster where RAGFlow shares a network with object storage and the metadata service, this gives a low-privilege user a way to scan internal services and learn their open ports and configuration. The record does not say this leads to data reads or code execution on its own.

Who can reach it

Any authenticated RAGFlow user who can reach the API over the network. Authentication is required, but only at a low privilege level.

What to do

Upgrade RAGFlow to 0.27.0 or later and restart the RAGFlow API service. Until then, block RAGFlow's outbound access to internal service ports and the cloud metadata endpoint at the network layer.

References

Related entries

• JupyterHub: unauthenticated logins write unbounded usernames to the log, exhausting storageCVE-2026-54338 · JupyterHub form-based login authenticators (failed-login logging)Medium
• vLLM: malformed JSON to the OpenAI-compatible endpoints returns server paths and versionsCVE-2026-73555 · vLLM OpenAI-compatible API server (validation_exception_handler, sanitize_message)Medium
• vLLM: attacker-supplied structured-output regex pins a CPU core and stalls the engine pathCVE-2026-73556 · vLLM structured outputs, lm-format-enforcer backend (structured_outputs.regex)Medium
• vLLM: integer overflow in the activation CUDA kernel leaks another batched request's outputCVE-2026-73558 · vLLM CUDA activation kernels (act_and_mul_kernel, activation_kernels.cu)Medium
• vLLM (DeepStream video backend, VideoMediaIO backend selection): A performance feature merged past two existingNCVD-2026-044-vllm-deepstream-video-backend-vi · vLLM (DeepStream video backend, VideoMediaIO backend selection)Medium
• NVIDIA OpenShell for Linux: improper output encoding in the inference proxy leaks data and allows tamperingCVE-2026-65085 · NVIDIA OpenShell for Linux (inference proxy)Medium