CVE-2026-75898 is an SSRF vulnerability in the RAGFlow product by infiniflow, affecting versions prior to 0.26.3. The vulnerability exists in the agent workflow "Invoke" component (agent/component/invoke.py), which builds outbound request URLs from canvas configuration and runtime template variables and calls requests.get, requests.post, or requests.put without invoking the shared URL safety validator or restricting the resolved addresses. This allows an attacker with the ability to create or trigger an agent to direct the server to fetch resources from internal network locations, including cloud metadata endpoints and other services on the deployment network. The response body from these requests is returned as output, potentially leaking sensitive information. The vulnerability is rated with a CVSS 4.0 score of 8.4 (high severity).

An attacker who can create or trigger an agent in RAGFlow versions before 0.26.3 can exploit this SSRF vulnerability to make the server perform HTTP requests to internal or restricted network resources. This includes accessing loopback addresses, link-local addresses, RFC 1918 private IP ranges, and cloud instance metadata endpoints. The attacker can receive the response body from these requests, potentially exposing sensitive internal data or cloud credentials. This could lead to information disclosure and further attacks within the internal network. There is no indication of known exploits in the wild at this time.

A fix is available in RAGFlow version 0.26.3 and later. Users should upgrade to version 0.26.3 or newer to remediate this SSRF vulnerability. Until upgraded, avoid allowing untrusted users to create or trigger agents that use the Invoke component. The vendor advisory or patch links are not provided here; users should consult the official infiniflow resources for the update.