CVE-2025-69286

RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability

No known exploitation. EPSS puts it in the 56th percentile. Fixed in 0.22.0.

CVSS 3.19.8Critical EPSS percentile56th0.8% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix0.22.0Upgrade to this build

Published 2025-12-31Updated 2026-09-23Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Infiniflow RagflowAffected: < 0.22.0Upgrade to: 0.22.0Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check your RAGFlow version (look for the running version/build number in your deployment logs or the UI/config).
If your version is older than 0.22.0, upgrade RAGFlow to 0.22.0 or later.
Confirm whether you use “shared assistant/agent” links (beta share/auth features). If yes and you can’t upgrade immediately, temporarily disable sharing of assistant/agent links and rotate any generated keys/tokens you use for access.
After upgrading, verify authentication still works as expected and that any previously issued shared links no longer grant access.

Vendor advisory Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta (assistant/agent share auth) token generation process allows these tokens to be mutually derivable. Specifically, both tokens are generated using the same `URLSafeTimedSerializer` with predictable inputs, enabling an unauthorized user who obtains the shared assistant/agent URL to derive the personal API key. This grants them full control over the assistant/agent owner's account. Version 0.22.0 fixes the issue.

In plain language

Written by AI from the record

CVE-2025-69286 is a serious RAGFlow token-guessing weakness that can let an attacker bypass logins and take over an assistant/agent account if they have the shared assistant/agent link; if you run RAGFlow and use those shared features, you should act now and upgrade to 0.22.0 or later.

In RAGFlow (versions before 0.22.0), predictable token generation (CWE-340) allows an attacker with access to the shared assistant/agent URL to derive the owner’s API key and bypass authentication, leading to full account takeover; exploitation is reported in the wild (actor: Qilin).

If you're affected

Full assistant/agent account takeover
Unauthorized API access
Data exposure from RAG workflows
Service disruption via abuse

What is it

RAGFlow uses tokens to prove that a user is allowed to access your assistant/agent. This bug makes those tokens too easy to predict when someone has a specific “shared link.” Think of it like using a lock with a code that follows a simple pattern—if someone knows the link, they can figure out the real key and walk in as you.

Who is affected

This matters if you run RAGFlow (open-source RAG engine) and you are using the beta assistant/agent “share” feature that relies on shared URLs. It’s specifically a risk when an attacker can obtain the shared assistant/agent URL tied to an owner account. The problem applies to RAGFlow versions before 0.22.0.

How urgent is it

This is RED because exploitation is reported in the wild (actor: Qilin), meaning attackers are actively using this weakness rather than it being theoretical. If you run RAGFlow with shared assistant/agent links and you’re on a version older than 0.22.0, you should treat it as an active account-takeover risk and remediate immediately.

What to do — in detail

Confirm exposure

Identify your running RAGFlow version.
- Check your deployment logs, UI “about/version” area (if available), or your Docker/image tag / build metadata.
Determine whether you use assistant/agent sharing (beta share/auth token flow).
- Look for any feature or setting that generates shared assistant/agent links used by others to access your assistant/agent.

If you are below the fixed version

If your version is older than 0.22.0, plan an upgrade to 0.22.0 or later.
Vendor fix references:
- commit: a3bb4aadcc3494fb27f2a9933b4c46df8eb532e6
- advisory: GHSA-9j5g-g4xm-57w7

Upgrade procedure (operational guidance)

Upgrade RAGFlow to 0.22.0 or later using your normal deployment method (container/image update or package update).
After upgrade, restart the service and validate:
- You can still sign in normally.
- Shared assistant/agent links behave as intended.
- Previously exposed/shared links no longer enable unauthorized access.

Temporary workaround if you can’t upgrade right away

Disable or stop using shared assistant/agent links.
Revoke/rotate any API keys or tokens used for assistant/agent ownership, if your deployment supports revocation.
Monitor access attempts and unusual behavior on assistant/agent endpoints.

What to monitor after patching

Unexpected logins or authentication bypass symptoms (e.g., access to other owners’ assistants/agents).
Spikes in API usage from unexpected sources.
Any audit logs related to assistant/agent sharing and token validation failures.

Technical context

Severity is consistent with a critical authentication bypass: RAGFlow versions before 0.22.0 use predictable token generation (CWE-340) for API key and beta assistant/agent share auth tokens. The mechanism allows mutual derivation when a shared assistant/agent URL is obtained, enabling an unauthorized user to derive the owner’s personal API key and take over the account.

Exploitation status: press attention indicates exploitation (actor: Qilin). There is no KEV entry and no public exploit code on record, but the “exploitation” report elevates urgency beyond predictions.

EPSS is reported as a low predicted likelihood with flat trend; however, the remediation decision follows the observed exploitation signal from findings.

Fix: upgrade to 0.22.0 (the vendor states 0.22.0 fixes the issue).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS56th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.8% chance of exploitation activity in the next 30 days, which ranks it in the 56th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 266 days, from the signal feeds we watch.

2026-09-23Patch availablerecord updated
2026-01-06Patch availablerecord updated
2025-12-31Publishedweakness classified

Affected products

infiniflowcommercialaka ragflow, infiniflow/ragflow
- ragflowMixedAI / ML / vector-db-rag

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable