CVE-2026-75898

creationtimestamp| type| source ---|---|--- 2026-08-18 15:03:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5426spvfhm6bd...

CVE-2026-75898 RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component

RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component agent/component/invoke.py. The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or...