What happened
RAGFlow's set_api_key endpoint accepts an attacker-supplied base_url value without validation and issues server-side requests to it. This enables authenticated SSRF to shared-network backends and cloud metadata services, with verbose upstream exception text returned in the response leaking internal service fingerprints.
Why it matters
RAG platforms are frequently deployed inside a VPC alongside the vector database, object storage, and model endpoints they index. This SSRF gives an authenticated (often low-privilege) user a pivot into that internal network and a path to cloud credentials via metadata.
Attack vector
POST /v1/llm/set_api_key with an unvalidated base_url (handled by set_api_key() in api/apps/llm_app.py) causes the server to make requests to attacker-chosen hosts (CWE-918 SSRF); error text returned to the client discloses internal service layout.
Affected systems
RAGFlow before 0.27.0
Mitigation
Upgrade to RAGFlow 0.27.0.