CVE-2026-75898 is a server-side request forgery vulnerability in the Invoke component of the RAGFlow product by infiniflow, affecting versions before 0.26.3. The vulnerable component builds outbound request URLs from canvas configuration and runtime template variables and calls requests.get, requests.post, or requests.put without invoking the shared assert_url_is_safe validator or pinning the resolved address. This contrasts with other components like the crawler or RSS fetch paths that do perform such validation. An attacker able to create or trigger an agent can cause the server to send requests to internal network addresses, including loopback, link-local, RFC 1918 ranges, and cloud instance metadata endpoints. The response body from these requests is returned as the component output, potentially exposing sensitive internal information. The vulnerability is rated high severity with a CVSS 4.0 score of 8.4. There is no vendor advisory or patch link provided, and the remediation level is not specified.

An attacker with the ability to create or trigger an agent in RAGFlow before version 0.26.3 can exploit this SSRF vulnerability to make the server perform HTTP requests to internal or restricted network resources. This includes access to loopback addresses, link-local addresses, RFC 1918 private IP ranges, and cloud instance metadata endpoints. The attacker can receive the response body from these requests as output, potentially exposing sensitive internal data or cloud credentials. This can lead to information disclosure and may facilitate further attacks within the deployment network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or monitor the ability to create or trigger agents in RAGFlow to trusted users only. Avoid exposing the agent workflow Invoke component to untrusted inputs. Consider network-level controls to limit server access to sensitive internal endpoints.