CVE-2026-75898

creationtimestamp| type| source ---|---|--- 2026-08-18 15:03:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5426spvfhm6bd 2026-08-27 04:00:04+00:00| seen| https://t.me/GithubRedTeam/99877 2026-08-27 12:00:05+00:00| seen| Telegram/ffKlG2fYJeqUeuQCHj3J9BzzMW6IY6h6bicEkkzdHSiG8...

CVE-2026-75898 RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component

RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component agent/component/invoke.py. The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or...