CVE-2026-6587: 
Python vulnerability analysis and mitigation

CVE-2026-6587 is a Server-Side Request Forgery (SSRF) vulnerability in vibrantlabsai RAGAS, an open-source LLM evaluation framework. The flaw resides in the _try_process_local_file and _try_process_url functions within the Collections Module (src/ragas/metrics/collections/multi_modal_faithfulness/util.py), and affects RAGAS versions 0.2.3 through 0.4.3. It was disclosed on April 19–20, 2026, with the CVE assigned by VulDB. The vulnerability carries a CVSS v3.1 base score of 6.3 (Medium) and a CVSS v4.0 score of 2.1 (Low) as assessed by GitHub Advisory (Github Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of user-supplied input in the retrieved_contexts argument passed to the _try_process_local_file and _try_process_url functions in the multi-modal faithfulness utility module (CWE-918). An attacker with low-level authenticated access can manipulate this argument to cause the server to issue arbitrary HTTP requests to internal or external destinations. Notably, a prior patch for the related CVE-2025-45691 addressed SSRF in a different module, leaving this code path unmitigated. The exploit has been publicly released, and a researcher write-up is available at adithyanak.com (Github Advisory, Red Hat Bugzilla).

Successful exploitation allows an authenticated attacker to make the RAGAS server issue arbitrary HTTP requests to internal or external resources, potentially exposing sensitive internal services, cloud metadata endpoints (e.g., AWS IMDSv1), or other network-accessible assets. The impact spans limited confidentiality loss (access to internal data), limited integrity impact (unauthorized interactions with internal services), and limited availability disruption. Lateral movement within the hosting network is a realistic secondary risk, particularly in cloud-hosted AI/ML pipeline environments (Github Advisory, Red Hat Bugzilla).

A public exploit or proof-of-concept has been released, as noted in the CVE description, though Feedly's executive summary indicates no confirmed in-the-wild exploitation at the time of reporting. The vulnerability requires low-privilege authentication and no user interaction, making it relatively straightforward to exploit remotely. The EPSS score is approximately 0.014% (3rd percentile), indicating a low near-term exploitation probability. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Reconnaissance: Identify deployments of vibrantlabsai RAGAS versions 0.2.3–0.4.3 in target environments, particularly those exposing multi-modal evaluation pipelines or APIs that accept user-supplied context inputs.
2. Authenticate: Obtain low-privilege credentials or API access to the RAGAS service (e.g., via a trial account or compromised user credentials).
3. Craft malicious payload: Prepare a request that supplies a malicious URL or file path as the retrieved_contexts argument targeting the multi-modal faithfulness metric evaluation endpoint.
4. Trigger SSRF: Submit the crafted input to invoke the _try_process_url or _try_process_local_file function, causing the server to fetch the attacker-controlled URL (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata, or an internal service endpoint).
5. Exfiltrate data: Retrieve the server's response to the forged request, potentially exposing cloud credentials, internal service data, or network topology information (Github Advisory).

• Network: Outbound HTTP requests from the RAGAS server process to internal IP ranges (e.g., 169.254.169.254, 10.0.0.0/8, 192.168.0.0/16) or unexpected external hosts; unusual DNS lookups originating from the RAGAS service.
• Logs: Application logs showing calls to _try_process_url or _try_process_local_file with non-standard or internal URLs as retrieved_contexts values; HTTP client errors or timeouts to internal endpoints in RAGAS logs.
• Process: Unexpected network connections initiated by the Python process running RAGAS to cloud metadata services or internal APIs not part of normal evaluation workflows.

As of the advisory publication, no patched version of RAGAS beyond 0.4.3 has been confirmed as released (GitHub Advisory lists "Patched versions: None"). Organizations should immediately restrict network access to the RAGAS service to trusted users only and implement egress filtering to block outbound requests from the RAGAS server to internal network ranges and cloud metadata endpoints. Monitoring for anomalous outbound HTTP requests from the RAGAS process is recommended as a detective control. Users should monitor the RAGAS GitHub repository for a patch release and upgrade as soon as one becomes available (Github Advisory, Red Hat Bugzilla).

The vulnerability was tracked by Red Hat's Product Security team via Bugzilla, assigned high severity, and flagged for internal review. The vendor (vibrantlabsai) did not respond to the researcher's disclosure attempts. A Bluesky post from a CVE tracking account noted the disclosure, and a brief write-up appeared on infinitsec.net. Overall community reaction has been limited given the niche scope of the affected library (Red Hat Bugzilla).