CVE-2026-49951

RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated base url to the POST /v1/llm/set api key endpoint handled by set api key() in api/apps/llm app.py. Attackers can exploit this flaw to probe shared-network services such as MySQL, Elasticsearch, Redis, MinIO, the Infinity vector database, and cloud metadata endpoints, with raw upstream exception text returned in the response leaking internal service details, open ports, and configuration fingerprints.