CVE-2026-49951 | Infiniflow RAGFlow up to 0.26.x Llm Api api/apps/llm_app.py set_api_key base_url server-side request forgery

November 6, 2026 Yanac

A vulnerability was found in Infiniflow RAGFlow up to 0.26.x and classified as critical. Affected is the function set_api_key of the file api/apps/llm_app.py of the component Llm Api. Such manipulation of the argument base_url leads to server-side request forgery.

This vulnerability is uniquely identified as CVE-2026-49951. The attack can be launched remotely. No exploit exists.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More