Personal API keys derivable from shared assistant links in RAGFlow (CVE-2025-69286)
Microsoft published a case study documenting RAGFlow compromise via its AI-infrastructure attack research, and any instance still exposing shared assistant or agent URLs on a pre-0.22.0 build is handing attackers the owner's API key.
RAGFlow before 0.22.0 generates personal API keys and assistant/agent share tokens with the same URLSafeTimedSerializer and predictable inputs, making the tokens mutually derivable. Anyone who obtains a shared assistant or agent URL can derive the owner's personal API key and gain full control of that account.
Affected: infiniflow RAGFlow < 0.22.0
How to Test
Confirm the running RAGFlow version is below 0.22.0, inventory any assistant/agent share URLs that have been distributed or exposed publicly, and review API access logs for API-key usage from unexpected sources.
How to Patch
Upgrade RAGFlow to version 0.22.0 or later, then rotate all personal API keys and invalidate previously issued assistant/agent share links, since keys derived from old share tokens remain valid until rotated.