Executive brief
RAGFlow is an open-source retrieval engine used to power document search and AI assistant features. Versions before 0.22.0 use predictable cryptographic keys for API tokens and shared assistant URLs, allowing an attacker who obtains a shared link to derive the account owner's private API key and take complete control of their account.
Technical details
The vulnerability exists in RAGFlow's API key and assistant/agent share token generation, which uses an insecure `URLSafeTimedSerializer` with predictable inputs. Both the personal API key and shared assistant/agent URL tokens are generated from the same serializer with derivable parameters, making them cryptographically related. An unauthorized user who obtains a shared assistant/agent URL can mathematically derive the account owner's private API key without additional authentication, granting full account compromise. The fix in version 0.22.0 implements proper cryptographic separation of these token types.
Affected products
- InfiniFlow RAGFlow prior to 0.22.0
Timeline
- 2025-12-31: disclosed