# CVE-2025-69286: RAGFlow insecure cryptographic key generation

Source: https://junglewise.ai/threats/cve-2025-69286-ragflow-insecure-cryptographic-key-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-69286 · Severity: critical · CVSS 9.8 · Published 2025-12-31

RAGFlow is an open-source retrieval engine used to power document search and AI assistant features. Versions before 0.22.0 use predictable cryptographic keys for API tokens and shared assistant URLs, allowing an attacker who obtains a shared link to derive the account owner's private API key and take complete control of their account.

Technologies: [InfiniFlow RAGFlow](https://junglewise.ai/threats/technologies/ragflow). Vendors: [InfiniFlow](https://junglewise.ai/threats/vendors/infiniflow).

## Quick answers

**Is CVE-2025-69286 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-69286 being exploited in the wild.

**How severe is CVE-2025-69286?** Critical severity, with a CVSS score of 9.8, published 31 December 2025.

**Which products and versions are affected?** InfiniFlow RAGFlow prior to 0.22.0.

**Is there a fix for CVE-2025-69286?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-69286 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-69286?** Check whether you run InfiniFlow RAGFlow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in RAGFlow's API key and assistant/agent share token generation, which uses an insecure `URLSafeTimedSerializer` with predictable inputs. Both the personal API key and shared assistant/agent URL tokens are generated from the same serializer with derivable parameters, making them cryptographically related. An unauthorized user who obtains a shared assistant/agent URL can mathematically derive the account owner's private API key without additional authentication, granting full account compromise. The fix in version 0.22.0 implements proper cryptographic separation of these token types.

## Affected products

- InfiniFlow RAGFlow prior to 0.22.0

## Timeline

- 2025-12-31: disclosed

## References

- [https://github.com/infiniflow/ragflow/blob/v0.20.5/api/apps/system_app.py](https://github.com/infiniflow/ragflow/blob/v0.20.5/api/apps/system_app.py)
- [https://github.com/infiniflow/ragflow/blob/v0.20.5/api/utils/__init__.py](https://github.com/infiniflow/ragflow/blob/v0.20.5/api/utils/__init__.py)

## Related threats

- [RAGFlow server-side request forgery in LLM API key endpoint](https://junglewise.ai/threats/cve-2026-49951-ragflow-before-0-27-0-contains-a-server-side-request-forgery)
- [InfiniFlow RAGFlow server-side request forgery in Seafile Connector](https://junglewise.ai/threats/cve-2026-121927-a-vulnerability-has-been-found-in-infiniflow-ragflow-up-to-0-27)
- [InfiniFlow RAGFlow authorization bypass in Text To SQL Retrieval](https://junglewise.ai/threats/cve-2026-121585-a-security-flaw-has-been-discovered-in-infiniflow-ragflow-up-to)
- [RAGFlow authorization bypass in OpenAI-compatible agent completion](https://junglewise.ai/threats/cve-2026-119337-ragflow-is-an-open-source-rag-retrieval-augmented-generation)
- [RAGFlow improper access control in get_dataset API endpoint](https://junglewise.ai/threats/cve-2026-51897-ragflow-0-24-0-contains-improper-access-control-in-get-dataset)