Disclosed weakness · no CVE recorded

RAGFlow exposed translation and weather service keys to the model

InfiniFlow · RAGFlow Go agent tools for DeepL and QWeather

First documented disclosure · Review checkpoint

Summary

Running either tool required giving the model the operator’s service key. The fix lets the server supply that credential when it calls the provider.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The maintainer describes how credentials were passed. The reviewed sources identify no victim, malicious use or unauthorized provider charges.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The Go agent advertised a credential as a model-facing input. The fixed tool definitions keep the key in server-side configuration.

Conditions required

An operator used the affected Go agent tool and supplied a working provider key through model context.

Potential impact

The model provider or a system retaining that context could receive the key. Subsequent access or unauthorized use was not documented.

Affected versions and configurations

Confirmed in the Go tool definitions at 1.0.0-rc3. The maintainer does not specify a full affected version range.

Fix and mitigation status

1.0.0 includes the merged change for both tools.

Practical next steps

Use the corrected tools and configure the two keys on the server. Rotate keys previously included in prompts and review who can access any retained copies.

Operating lesson

Give a tool access to its credential at execution time without passing the credential through the model.

Evidence and limits

The October 30 pull request merged November 2. The November 6 release names the fix. A comparison of the rc3 and final tool definitions confirms the credential field was removed from the model-facing interface.

Sources