RAGFlow Review 2026: A Free RAG Engine With Excellent Document Handling, a $29 Cloud Plan, and a Go 1.0 That Is Not Finished Yet
RAGFlow turns scanned PDFs, spreadsheets and slide decks into searchable chunks and answers questions with citations back to the page. The software is Apache-2.0 and free to run yourself; InfiniFlow also sells a hosted version. This review works out what each route really costs, what the new Go release changes, what the security record and legal pages say, and where the public evidence runs out.
There are no affiliate links in this review. Every RAGFlow link goes straight to ragflow.io, its documentation or its GitHub repository.
| Made by | InfiniFlow Inc. (site footer) |
| What it is | Open-source RAG engine and agent platform; self-hosted or hosted at cloud.ragflow.io |
| Cloud plans | Free $0; Starter $29/mo; Pro $129/mo; Enterprise custom |
| Self-hosting | Software $0; about $128 a month on a 16 GB cloud server with API models (worked example) |
| Newest release | v1.0.0-rc2, 16 Oct 2026; last stable line v0.27.2 |
Pick RAGFlow for hard documents and inspectable citations. Run the stable 0.27.2 line or the cheap cloud plan today, and treat 1.0 as something to test on a copy.
“Build a superior context layer for AI agents.” That is the pitch on ragflow.io, sitting on a repository with 92,402 GitHub stars on 18 Oct 2026, up from the 77.5k a security firm counted on 8 Apr 2026.
RAGFlow’s real strength is the boring part of retrieval: getting text, tables and images out of messy files in a shape a model can use, then showing you the chunks so a person can fix them. The vendor’s own documentation screenshots show a dataset view where every chunk of a product brief, including a full specification table, sits beside the original page, and a chat answer that cites the exact table it used. Few open-source tools make that review step this visible.
The money side is simple on the surface. The hosted plans are Free, Starter at $29 a month and Pro at $129 a month, each shown beside a crossed-out price ($59 and $259) that the page does not explain. Self-hosting is free software, but our worked example puts a realistic 16 GB server plus API model costs at about $128 a month, almost exactly the Pro price.
The timing is the catch. On 29 Sep 2026 RAGFlow shipped a ground-up rewrite in Go as v1.0.0-rc1, followed by rc2 on 16 Oct. The image download shrank by about 90%, but the migration from v0.27.2 is mandatory for future versions and cannot be undone, 115 issues were opened against the project in the 19 days after rc1, and one open report says the new Go bootstrap creates the first admin as admin/admin whatever you set. Add eight published security advisories (five critical) and Terms of Use that still read “[Specify jurisdiction]”, and RAGFlow is a strong engine that needs a careful operator.
Not a hands-on test: JAVIS has not installed RAGFlow or opened a cloud account for this review. It is built from RAGFlow’s website, documentation, release notes, legal pages, Docker configuration files and GitHub repository, Docker Hub and PyPI counters, Hacker News, a security firm’s report, GitHub issues, and competitors’ and hosting providers’ pricing pages, all as of 18 Oct 2026. Parsing quality and answer accuracy are the vendor’s claims, not measurements.
One pipeline from file to cited answer; you supply the models, RAGFlow supplies everything in between.
The documentation describes the same loop everywhere: start the server, connect a chat model and an embedding model, create a dataset, upload files, parse them into chunks, check the chunks, then ask questions through Chat, Search or an Agent. RAGFlow does not ship its own language model. It calls whichever provider you configure, or a local model through Ollama or vLLM.
A top-tier open-source RAG project by attention, run by one company, and moving at an unusual pace.
infiniflow/ragflow, 18 Oct 2026; 11,021 forks
3,911,816 for infiniflow/ragflow, 18 Oct 2026
18 Sep to 17 Oct 2026
ragflow-sdk on PyPI, per pypistats
The repository was created on 12 Dec 2023 and is licensed Apache-2.0; the site footer names InfiniFlow Inc. as the company. Stars are attention, not customers: they show how many GitHub users bookmarked the project. The Docker Hub counter is closer to real installs but still counts every repeated and automated pull (the Docker Hub web page itself rounds the figure down to “1M+”). The Python SDK’s 16,323 monthly downloads are a hint that far fewer teams call RAGFlow from code than pull the image. No funding round, revenue or customer count is quoted here because none was confirmed by an independent source.
The pace is the striking number. In the 30 days to 17 Oct 2026 the project merged 822 pull requests, while 157 new issues were opened and 27 of those were closed in the same window (17%). Releases have come steadily: 19 in 2024, 19 in 2025 and 18 so far in 2026, ending with v0.27.0 (19 Aug), v0.27.1 (28 Aug), v0.27.2 (10 Sep), v1.0.0-rc1 (29 Sep) and v1.0.0-rc2 (16 Oct). GitHub’s language bar now reads 69.9% Go, 22.2% TypeScript and 3% Python, a codebase that changed language in a few months.
No analyst market-share figure is cited. Stars, pulls and downloads measure attention and installs, not paying customers.
No star rating exists. The public record is a 2024 launch thread, a 2026 security report, and a busy issue tracker that shows what breaks.
RAGFlow has no Trustpilot profile, no G2, Capterra or Product Hunt listing we could find, and no mobile app to rate, so there is no independent score to quote. What does exist is a large GitHub issue tracker, where users describe concrete problems with versions and steps, plus Hacker News. Each item below is one person’s account, not a verified finding.
What early testers said (April 2024)
Took time to get running, then found the layout model “pretty good”: it caught tables, including one-column ones, that the AWS Textract service missed. Added that without a benchmark the result could be luck, and that mixing several PDF parsers seemed odd.
Pointed out that “deep document understanding” means OCR and structured parsing, asked how well it works, and asked for benchmarks.
Regretted that RAG engines reimplement parts like the PDF parser in ways that are “pretty much useless” outside their own engine, instead of reusable building blocks.
Two more launch-day notes have aged: gardenfelder (comment 39898012) said it seemed limited to certain model servers and that the Discord channels were named in Chinese, and NKosmatos (comment 39900324) wished it supported local models out of the box. The docs now cover Ollama and vLLM. A RAGFlow maintainer, yingfeng (comment 39903903), replied that the team had tried almost all open models for complex tables, found none good enough, and built its own. That is a vendor statement, not a measurement, and the benchmark request from 2024 has still not been answered with an independent number.
What users report on the 1.0 release candidates (Sep to Oct 2026)
On a fresh Go Compose deploy, changingADMIN_DEFAULT_PASSWORDindocker/.envhas no effect: the first superuser is always created asadmin@ragflow.iowith passwordadmin. Two contributors have opened competing fixes; none is merged as of 18 Oct 2026.
On rc1 with 18 PDFs, retrieval testing finds the right chunk but chat answers that the sources are insufficient. The reporter said a nightly build fixed it on 15 Oct, then that the behaviour came back on 16 Oct.
The local MinerU parser provider was unusable end to end on rc1: verification always failed and parsing hit an empty server address. A maintainer says verification is fixed on the main branch (10 Oct) with a follow-up fix pending.
Other open reports from the same weeks include memory that keeps growing during chat on v0.27.1 (issue 20377) and an admin login that knocks out a regular user’s session in the same browser on rc1 (issue 20409). The longest-standing requests are telling too: integrate the Docling parser (issue 3443, 26 thumbs-up, the most of any open request), add reranking for Ollama (issue 4406, 27 reactions in total, 17 of them thumbs-up), support Qdrant as the vector store (issue 6546, 10 thumbs-up), one-click backup and export of knowledge bases and agents (issue 3178, open since 4 Nov 2024) and AMD GPU support (issue 2457, open since 16 Sep 2024).
A security firm’s account, and what happened next
Reported a post-login remote-code-execution flaw in RAGFlow 0.24.0 on instances using Infinity for chunk storage, said it filed a private GitHub report on 3 Mar 2026 and got no reply to several emails, published a fix as pull request 14091, and counted at least 1,918 RAGFlow instances open to the internet via Shodan.
“Fix tag_feas code injection in retrieval ranking”, opened by an outside contributor on 3 Apr 2026, was merged on 15 Apr, two days after ZeroPath’s public pull request, and the maintainer pointed ZeroPath to it. The fix is in v0.25.0 (21 Apr 2026); ZeroPath’s own pull request was closed unmerged on 6 May.
The report ZeroPath filed (GHSA-vw46-rrp3-c99v) is not among the eight published advisories. If you track risk through advisories alone, this RCE would not appear; it is fixed from v0.25.0.
How big is this evidence?
Small, and partly vendor-made. Hacker News search returns 17 items mentioning RAGFlow since 1 Jan 2025; four are unrelated (two NYC rat-map posts and two uses of the phrase “RAG flow”). Of the 13 relevant items, six were posted by RAGFlow team members, and only one story passed 10 points: the launch of a security-scanning startup (item 44747204, 31 Jul 2025, 66 points) whose founder said its tool had found CVEs in projects including RAGFlow. Independent written opinion after 2024 is therefore thin. The issue tracker is the larger and more current sample: 115 issues opened in the 19 days after rc1. A GitHub issue search on 18 Oct 2026 for issues created 29 Sep to 18 Oct returns 21 containing “migration” and 23 containing “migration” or “upgrade”, but only one has the word in its title (issue 20622, an Elasticsearch-to-OceanBase migration tool bug), so most are passing mentions rather than failed upgrades.
6 by RAGFlow team; 1 above 10 points
29 Sep to 17 Oct 2026; 16 closed
opened 29 Sep to 18 Oct; 1 in the title
Aug 2026; 11,245 in Apr 2026
The Python SDK’s monthly downloads (pypistats, excluding mirrors) give a rough adoption trend for teams that call RAGFlow from code: 11,245 in April 2026, 16,551 in May, 18,398 in June, 16,965 in July, 22,923 in August, 19,087 in September and 6,860 in the first 17 days of October. That is growth through the summer and a dip in September, the month the Go rewrite arrived; one month is too short to call a trend.
Three more open rc reports matter for anyone upgrading. Issue 20651 (9 Oct 2026): on rc1, dataset settings cannot be saved when the dataset still holds old RAPTOR configuration, even if the user changed something unrelated. Issue 21025 (15 Oct 2026, filed by a project collaborator): the rc2 settings conversion skips databases that already ran an earlier cleanup step, leaving old flat settings behind. Issue 20396 (29 Sep 2026, also a collaborator): a Go endpoint returns a model provider’s full, unmasked API key. And for large libraries, issue 20777 (11 Oct 2026) reports that the Go knowledge-compilation backlog is stored in a text column that holds about 530 entries, beyond which completions are silently dropped.
Read together: early testers liked the parsing and doubted the architecture; current users are filing detailed bug reports against a fast-changing release candidate; and the project’s security response in 2026 was slow to acknowledge but did ship a fix. None of this is a satisfaction score, and none of it measures your documents.
Free, then Starter at $29 and Pro at $129 a month, each beside a crossed-out price, then Enterprise on request.
Free
- 5 apps, 1 team member
- 0.1 GB dataset storage
- 500 credits a month
- API key not available
Starter
Crossed-out: $59
- 50 apps, 5 team members
- 5 GB dataset storage
- 5,000 credits a month
- API key available
Pro
Crossed-out: $259
- Unlimited apps, 20 members
- 50 GB dataset storage
- 20,000 credits a month
- API key available
Enterprise
- BYOC deployment
- On-premises deployment
- Dedicated support
- Custom SLA
Swipe the table sideways to see every column.
| Limit | Free | Starter | Pro | Enterprise |
|---|---|---|---|---|
| Price a month | $0 | $29 (crossed out $59) | $129 (crossed out $259) | Custom |
| Apps | 5 | 50 | Unlimited | Not listed |
| Team members | 1 | 5 | 20 | Not listed |
| Dataset storage | 0.1 GB | 5 GB | 50 GB | Not listed |
| Credits a month | 500 | 5,000 | 20,000 | Not listed |
| API key | No | Yes | Yes | Not listed |
| BYOC, on-premises, SLA | No | No | No | Yes |
Not an affiliate link. It opens RAGFlow’s official website.
Self-hosting is not free in practice: a properly sized server costs about what the Pro plan costs, and model bills are small next to it.
Everything below is arithmetic on published prices (RAGFlow’s plan section, DigitalOcean’s droplet price list and OpenAI’s API price list, all as of 18 Oct 2026) with invented but plausible workloads. It is an illustration, not a quote and not a measurement.
$708 at the crossed-out price
$3,108 at the crossed-out price
DigitalOcean, 4 dedicated vCPUs, 50 GiB
3,000 questions, worked example 4
Worked example 1: one person trying it
The Free cloud plan covers 5 apps and 0.1 GB of files, which is roughly one or two large scanned PDFs. It has no API key, so you cannot call it from your own code. Cost $0; the limit you hit first is the API, not the storage.
Worked example 2: a team of four with 3 GB of documents
Starter fits (5 members, 5 GB): $29 × 12 = $348 a year. If the crossed-out $59 becomes the real price, the same year costs $708, $360 more. For comparison, Dify’s Professional cloud plan is $59 per workspace a month on 18 Oct 2026 with 3 members, 50 apps, 5 GB of knowledge storage and 5,000 message credits. Today RAGFlow Starter is about half that price (2.03 times cheaper) for similar headline limits; at its crossed-out price it would cost the same.
Worked example 3: a team of eight with 20 GB
Starter caps at 5 members and 5 GB, so Pro: $129 × 12 = $1,548 a year, or $3,108 at the crossed-out price. That is about $16 a member a month. Per GB of storage, Pro costs $2.58 against $5.80 on Starter ($129 / 50 and $29 / 5), so heavy document libraries get cheaper per unit on Pro.
Worked example 4: running it yourself
The quickstart’s recommended start is 4 x86-64 cores, 16 GB of RAM and 50 GB of disk. DigitalOcean’s General Purpose droplet with 16 GiB, 4 dedicated vCPUs and 50 GiB SSD is exactly that, at $126.00 a month; its Basic droplet with 16 GiB, 8 shared vCPUs and 320 GiB is $96.00. Now the models. Embedding 2,000 documents of 20 pages at about 500 tokens a page is 20 million tokens; at $0.02 per million tokens for OpenAI’s text-embedding-3-small that is $0.40, once. Answering 3,000 questions a month, each sending 8 chunks of RAGFlow’s default 512 tokens plus prompt (about 5,000 input tokens) and getting 500 tokens back, is 15 million input and 1.5 million output tokens; at gpt-6-luna’s $0.10 and $0.50 per million that is $1.50 + $0.75 = $2.25 a month. Total on the General Purpose droplet: about $128.25 a month, $0.75 less than Pro. Against Pro at its crossed-out $259, self-hosting would save about $130.75 a month.
Two self-hosted workloads, sized from the defaults
Two facts from the rc2 Docker files shape the server choice. The default stack runs six containers, and only Elasticsearch has a memory cap: MEM_LIMIT=8073741824 bytes, about 7.5 GiB. On a 16 GiB machine that leaves roughly 8 GiB for RAGFlow, MySQL, object storage, Kvrocks, NATS and the operating system. The RAGFlow image itself is now small (0.36 GB compressed for rc2 against 3.80 GB for v0.27.2), so disk goes mostly to your documents and indexes. The prices below are the DigitalOcean and OpenAI figures from 18 Oct 2026; the document counts, page sizes and question volumes are invented.
1,000 documents × 20 pages × 500 tokens = 10 million tokens to embed: $0.20 once. 1,000 questions a month at 5,000 input and 500 output tokens: 5 million × $0.10 + 0.5 million × $0.50 per million = $0.50 + $0.25 = $0.75. Server: Basic 16 GiB, 8 shared vCPUs, 320 GiB at $96.00. About $96.75 a month. If five people and 5 GB are enough, cloud Starter at $29 is cheaper.
20,000 documents × 20 pages × 500 tokens = 200 million tokens: $4.00 once to embed, about $20.00 of input tokens for one knowledge-compilation pass (output not estimated). 30,000 questions a month: 150 million × $0.10 + 15 million × $0.50 = $15.00 + $7.50 = $22.50. Server: General Purpose 32 GiB, 8 dedicated vCPUs, 100 GiB at $252.00, because CPU-only parsing benefits from cores and Elasticsearch needs a higher cap. About $274.50 a month.
Workload B is above Pro’s 50 GB and 20 members only if your files are; whether 30,000 questions fit Pro’s 20,000 credits cannot be judged because RAGFlow does not say what a credit buys. Knowledge compilation at this size also runs into the backlog limit reported in issue 20777.
MEM_LIMIT=8073741824 in the rc2 docker/.env). Local models, OCR-heavy parsing, knowledge compilation (which runs an LLM over your documents) or vision parsers (which the docs say add “model calls and token usage”) push you to a bigger machine or a bigger API bill. Self-host for control or data location; the savings appear only against the crossed-out prices or above Pro’s 50 GB and 20 members.Two different products with one name: the docs say so plainly.
RAGFlow’s FAQ describes cloud.ragflow.io as the hosted service with “subscription-based limits and features”, while a local deployment gives you “control over deployment, data, models, storage, and system resources”. REST API access on the cloud depends on the plan; a local install exposes the HTTP APIs directly with keys created in its own interface.
| Question | Self-hosted | Cloud |
|---|---|---|
| Software price | $0, Apache-2.0 | $0, $29, $129 a month, or custom |
| Who runs it | You: six containers by default | InfiniFlow |
| Version | Your choice: 0.27.2 or 1.0 RC | Not stated on the plan page |
| Limits | Your hardware; 1 GiB per file in the file manager, 128 MiB per dataset upload | Apps, members, storage, credits |
| API | Yes, keys from the web app | Starter and above |
| Where data lives | Your server | Not stated; privacy policy says data may be processed in other countries |
Match your situation to one line.
latest. For local chat and embedding models, see the Ollama review.Template-based chunking, a chunk view beside the original page, hybrid retrieval and citations you can click.
Supported inputs, per the quickstart: documents (PDF, DOC, DOCX, TXT, MD, MDX), tables (CSV, XLSX, XLS), images (JPEG, JPG, PNG, TIF, GIF) and slides (PPT, PPTX). For each dataset you choose an embedding model and a chunking method (template) matched to the layout: manuals, papers, books, Q&A, tables and so on. DeepDoc, the built-in parser, handles OCR, layout and table structure; the dataset settings also let you route difficult PDFs, tables or images to an external vision model, which the docs warn adds model calls and token usage. Default chunk size is 512 tokens.
Note, 18 Oct 2026: the images in this section are the vendor’s own product screenshots from the RAGFlow documentation. Their dates and settings show they were taken in 2025 on the 0.2x interface, so the 1.0 screens may differ in detail.
This is the part users praise and the part you should test. Double-clicking a chunk lets you edit its text or add keywords and questions that raise its ranking. Then Retrieval testing shows exactly which chunks a question would pull, with hybrid, term and vector similarity scores, before any model writes an answer.
Knowledge Compilation and agentic retrieval
Since v0.27.0 (19 Aug 2026), Knowledge Compilation uses a language model to turn documents into structured artifacts: a knowledge graph, a tree, a page index, a mind map, a timeline or interlinked wiki-style pages. The older GraphRAG and RAPTOR features were deprecated and removed from the interface, though content they generated stays searchable; if you built on them, check before upgrading. Compilation runs an LLM across your documents, so it is a real token cost on large libraries.
Chat can also retrieve in several rounds. The documentation’s screenshot shows thinking modes from Naive to Ultra; the rc2 release note says a single Agentic mode now replaces the Low, Medium, High and Ultra levels. Expect the control on your screen to differ from older guides.
The quickstart warns that once a file is parsed with an embedding model, that dataset’s embedding model can no longer be changed. Pick it before you load your whole library.
Six steps from an empty Linux server to a cited answer, per the quickstart.
vm.max_map_count of at least 262144 for Elasticsearch.v1.0.0-rc2. For production, staying on v0.27.2 is the conservative choice until 1.0 is final.docker/.env, set ENABLE_REGISTER=0, and plan to change the admin password at first login (issue 20559).docker compose -f docker-compose.yml up -d, then poll /api/v1/system/healthz until it succeeds before opening the web app.An illustrative sequence built from RAGFlow’s quickstart, configuration docs and rc2 Docker files, 18 Oct 2026; not a record of a JAVIS install.
A visual agent canvas that mixes retrieval, tools, code and MCP, and can be embedded in a web page.
Agents start from a Begin node; you add Agent, Retrieval, Message, Switch, Iteration, Categorize, Code, Text Processing and tool nodes such as web search. The home page shows templates for equity research, legal precedent analysis and maintenance support. The Code component runs Python or JavaScript only after an administrator picks a sandbox provider (your own containers, an SSH server or a managed cloud sandbox); the rc1 notes list the old local sandbox as no longer supported. Two of the eight security advisories are template injections leading to code execution, one in the agent Text Processing component and one in the Prompt Generator, so treat agent builders as privileged users.
A three-tool MCP server, an HTTP API and Python SDK, and a long list of model and data-source connectors.
The MCP Tools page says the Go runtime registers three tools: ragflow_retrieval, ragflow_list_datasets and ragflow_list_chats. Calls run as the user chosen by the endpoint’s authentication mode and time out after 60 seconds. Retrieval defaults to 10 results per page (up to 100), considers up to 1,024 candidates, and page × page size must stay within a fixed window of 512 rerank candidates or the request fails. If no dataset is named, it searches every dataset the user can see, so scope the MCP user narrowly. RAGFlow can also call external MCP servers from agents.
For code, there is the HTTP API and the ragflow-sdk Python package (stable 0.27.2, with 1.0 release candidates published; it requires Python 3.13). The rc1 notes say the SDK is unaffected by the rewrite but deprecated API aliases are gone. Connectors keep arriving: Azure DevOps and Sitemap sources in 0.27.x; Firecrawl and Search1API search tools, the MinerU 4 parser and two more model providers in rc2. For web data inside agents, see the JAVIS review of Firecrawl; for local models, Ollama; for wiring MCP servers into Claude, Claude MCP connectors.
A much smaller image and a one-way door: what 1.0 changes, and why to wait.
The rc1 notes (29 Sep 2026) call 1.0 “a comprehensive rewrite of RAGFlow in Go” that cuts resource use. The message queue moved from Redis to NATS and Kvrocks now stores the cache and checkpoints. The visible result is in Docker Hub’s own size figures: the compressed amd64 image fell from 3.80 GB for v0.27.2 to 0.36 GB for rc1 and rc2, about 90% smaller. That is the RAGFlow image only; Elasticsearch, MySQL and the other services still download separately.
The cost of the change is in the migration guide. It is headed “Mandatory And Irreversible V0.X To V1.X Upgrade”: every 0.x deployment must first run and pass verification on v0.27.2, then move to v1.0.0-rc1, and that step cannot be rolled back. Tag datasets made by the Python backend stop being valid. Known issues at rc1 were CPU-only DeepDoc (the FAQ confirms no GPU inference in the open-source 1.0 parser), no local code sandbox, and no Team/Me sharing; rc2 added Team/Me sharing and arm64 images, and keeps rc1 data compatible.
latest tag with the same image digest (100be650c782) and the same amd64 digest shown here (141670c7d25b), so both tags are the same release candidate.latest tag now carries the same rc2 image (pushed 16 Oct 2026), and the rc2 docker/.env sets RAGFLOW_IMAGE=infiniflow/ragflow:v1.0.0-rc2. Anyone who pulls latest or follows the current quickstart onto an existing 0.x install starts a release candidate and, after the migration, cannot go back. Back up, pin your version, and rehearse the upgrade on a copy.Run 0.27.2 now, or wait for 1.0 final?
CheckCanvasPermission with the run operation); JAVIS has not tested it. On 0.27.2, allow only trusted accounts and set ENABLE_REGISTER=0.v1.0.0 tag exists (rc2 on 18 Oct 2026); issue 20559 is closed (fix pull requests 20562 and 20565 still open); issues 20651 and 21025 are resolved if your datasets used RAPTOR or development builds; issue 20396 (unmasked model API key) is closed; and you have restored your v0.27.2 backup on a test machine once.Issue and pull request states as of 18 Oct 2026, from the infiniflow/ragflow repository and its security advisories.
Which open 1.0 issues block which use
| If you need | Open issues | Risk on rc2 |
|---|---|---|
| To upgrade 0.x data | 20651, 21025 | Old RAPTOR settings block saves; some settings stay unconverted |
| Several users or teams | 20559, 20409, 20396 | admin/admin; admin and user sessions collide; model API key shown in full |
| Agents behind an API | 20582, 20614 | Structured output ignored; a middle step can be saved as the answer |
| Offline or local parsing | 20453, 21033 | Local MinerU parser broken in rc1 (fix pending); Ollama options ignored |
| Large compiled libraries | 20777 | Compilation backlog past about 530 documents drops entries |
| Grounded chat answers | 20922 | Refuses although retrieval found the answer (one report, not consistently reproduced) |
Eight published advisories, five critical, and defaults that assume a private network.
GitHub lists eight published security advisories for the repository on 18 Oct 2026. The table shows each with the affected range as the advisory states it.
Swipe the table sideways to see every column.
| Published | Severity | Issue | Affected, per advisory | Patched version listed |
|---|---|---|---|---|
| 5 Oct 2026 | High (7.1) | OpenAI-compatible agent completion bypasses private agent authorization | 0.25.2 to 0.27.2 | None listed |
| 9 May 2026 | Critical (9.9) | Template injection in Prompt Generator leads to remote code execution | 0.24.0 and earlier | None listed |
| 1 Apr 2026 | Critical | Template injection in the Agent Text Processing component leads to remote code execution | v0.24.0 | None listed |
| 27 Jan 2026 | Critical (9.8) | Zip Slip remote code execution in MinerUParser | 0.23.1 | None listed |
| 31 Dec 2025 | High | Remote code execution | 0.22.0 plus 31 commits, possibly earlier | None listed |
| 31 Dec 2025 | Critical | Predictable token generation leads to authentication bypass | Below 0.20.5 | None listed |
| 25 Feb 2025 | Critical | SQL injection | 0.15.1 and earlier | None listed |
| 21 Feb 2025 | High (8.1) | Insecure direct object reference | v0.13.0 | v0.14.1 |
Read the “patched version” column carefully: a blank means the advisory did not fill in that field, not that no fix exists. What the list does show is a pattern of serious server-side bugs in 2026, and the newest one, published 5 Oct 2026, covers every release from 0.25.2 to the current stable 0.27.2. Add the ZeroPath report above, fixed in v0.25.0 but never published as an advisory.
The defaults you should change
| Default in rc2 | Why it matters | What to do |
|---|---|---|
ENABLE_ | Anyone who reaches the page can create an account | Set to 0 (documented) |
Admin admin@ / admin | Issue 20559: the Go bootstrap ignores the password you set | Change it at first login; keep the admin port private |
Service passwords infini_ | Same default for Elasticsearch, MySQL, object storage and more; the file opens with “DO NOT DEPLOY WITH DEFAULT PASSWORDS” | Replace all before first start |
| Published ports | Web 80/443, API 9380 and admin 9381, plus Elasticsearch 1200, MySQL 3306, object storage 9000 and 9001, Kvrocks 6379 and NATS 4222 on the host | Firewall everything except the web port; put that behind a VPN or authenticating proxy |
docker/.env and docker-compose.yml in the repository, the Configurations page and GitHub issue 20559, 18 Oct 2026.ZeroPath counted at least 1,918 RAGFlow instances open to the internet in April 2026. With a public sign-up switch on by default and a weak first admin password on the Go line, an exposed instance is an easy target. Keep it private, patch quickly, and treat anyone who can build agents or upload files as a trusted user.
The cloud’s Terms of Use still contain template placeholders, and the contracting entity is not clear.
If you put company documents into cloud.ragflow.io, these pages are the contract. All three are dated “Last Updated: 2026-04-23”.
Section 14 reads “Governing Law: [Specify jurisdiction]” and “Venue / Dispute Resolution: [Courts / arbitration / mediation terms]”. The liability cap is “the amount you paid … in the [12] months” before the claim, or $100 if you paid nothing.
Names “RAGFlow, Inc.” as processor while the site footer says InfiniFlow Inc. No training of proprietary foundation models on customer personal data unless agreed in writing; breach notice within 72 hours where feasible; 30 days’ notice of new subprocessors, with the list provided on request or made public; deletion or return within 30 business days.
“The registered name and address of the Company will be provided upon request or made available through appropriate official channels where required by applicable law.” Data may be processed in other countries; no hosting region is named.
![RAGFlow Terms of Use sections 13 to 15 on a dark page; under 14 Governing Law and Disputes the text reads Governing Law: [Specify jurisdiction] and Venue / Dispute Resolution: [Courts / arbitration / mediation terms]](https://javisreview.com/wp-content/uploads/2026/10/ragflow-terms_law.png)
Two practical consequences. First, the DPA says governing law follows the “Principal Agreement”, and the public Terms leave that blank, so a self-serve customer has no stated jurisdiction; an Enterprise order form is the place to fix that. Second, section 9.2 says the service does not include long-term backup of your data: “Customer is responsible for its own backups.” Combined with the long-open export request (issue 3178), keep your source files elsewhere. The DPA does say a detailed security addendum and any third-party attestations are available on request; the public pages do not name SOC 2, ISO 27001 or HIPAA.
For self-hosting the picture is cleaner: the privacy policy says RAGFlow generally does not receive data from a self-hosted instance unless you enable optional features such as cloud connectors, telemetry or support logs. That, plus the Apache-2.0 license, is the strongest argument for running it yourself.
This is a reading of the public pages, not legal advice; we have not seen an Enterprise agreement or the security addendum.
Teams with hard documents and someone to run Linux; not buyers who need a finished, certified product today.
- Teams whose files are scans, tables or mixed layouts and who want to inspect and correct chunks by hand.
- Developers who want a self-hostable RAG backend with an HTTP API, Python SDK and MCP server.
- Organisations that must keep documents on their own servers (Apache-2.0, no data sent to the vendor by default).
- Small teams happy with a vendor-hosted copy at $29 a month while the price lasts.
- Anyone who needs a stable 1.0 now, or a clean upgrade path without an irreversible migration.
- Buyers who need a named jurisdiction, a hosting region or compliance reports from public pages.
- Small, clean document sets that a desktop app handles in minutes.
- Teams without someone to patch and harden a six-container stack.
- Native macOS or Windows installs; the documented target is Linux x86-64 Docker.
Ten things to check before you rely on it.
1.0 is rc2; the 0.27.2 to 1.0 migration is mandatory for future versions and irreversible.
Pulling latest gets the release candidate since 16 Oct 2026.
Eight advisories, five critical; the newest covers 0.25.2 to 0.27.2.
Public sign-up on; admin/admin reported on the Go line (issue 20559).
Crossed-out prices, undefined credits, no billing period.
Jurisdiction placeholders; entity named only on request; no backup in the DPA.
No GPU inference in the open-source DeepDoc; large libraries may parse slowly.
Changing it means re-parsing the dataset.
No one-click export (issue 3178), no Qdrant (6546), no AMD GPU (2457).
JAVIS did not run RAGFlow; no parsing or accuracy benchmark exists here.
Priced on the same day from each vendor’s page; the plans are not like-for-like.
| Product | Price, 18 Oct 2026 | JAVIS |
|---|---|---|
| RAGFlow Hard documents | Self-host free; cloud $29 or $129 a month | This article |
| Dify Visual app builder | $59 or $159 per workspace a month | Not reviewed yet |
| AnythingLLM Private doc chat | Self-host free; hosted $50 or $99 a month | Review |
| LlamaIndex Parsing for your code | Credits: $50 or $500 a month | Review |
| Open WebUI Self-hosted chat | Self-hosted; no price list | Review |
| LangChain Build RAG in code | Framework free | Review |
| Vector database DIY parsing and chat | Qdrant support is an open RAGFlow request | Qdrant, Weaviate |
The details behind those cells: Dify’s Professional plan ($59, or $590 a year) gives 3 members, 50 apps, 5 GB of knowledge storage and 5,000 message credits, and its page lists the commercial license only under Enterprise next to a self-hosted Community edition. AnythingLLM’s hosted Basic plan ($50) says “just bring an LLM API key”; Pro ($99) adds a 72-hour support SLA. LlamaIndex’s Starter ($50) includes 40K credits and Pro ($500) 400K, plus a limited-time 800K bonus for business email domains, at 1,000 credits = $1.25. Open WebUI has no price list at openwebui.com/
This review has no affiliate links, and InfiniFlow did not see it.
JAVIS has no approved RAGFlow affiliate link, so every RAGFlow link here goes straight to ragflow.io, its documentation or GitHub, with no tracking parameters.
Hands-on status: JAVIS has not installed RAGFlow, opened a cloud account or paid for a plan. Facts come from ragflow.io, its documentation, release notes and legal pages, the GitHub repository and its v1.0.0-rc2 Docker files, Docker Hub and PyPI counters, the official YouTube channel, Hacker News, ZeroPath’s report, GitHub issues, and the Dify, AnythingLLM, LlamaIndex, DigitalOcean and OpenAI price pages, as of 18 Oct 2026. Independent review evidence is limited, as described above.
Use the quickstart on a spare Linux machine with your hardest documents, and pin the version.
Open the RAGFlow quickstartRead the advisories and the terms before you upload company files.
Open the advisoriesBuilding with retrieval? These reviews cover the nearest ground.
Each card opens a published JAVIS review.
Questions people ask before committing
How much does RAGFlow cost in October 2026?
Per ragflow.io on 18 Oct 2026: Free $0, Starter $29 a month (crossed-out $59), Pro $129 a month (crossed-out $259), Enterprise custom. The software is free to self-host under Apache-2.0.
Is self-hosting cheaper than the cloud?
Not by much at today’s prices. A 16 GB server matching the recommended spec is $126 a month on DigitalOcean, and modest API model use adds about $2.25, so about $128.25 against Pro’s $129. Self-hosting is about control and data location.
Should I install version 1.0?
Not in production yet. On 18 Oct 2026 the newest release is v1.0.0-rc2, a release candidate, and the migration from v0.27.2 is irreversible. Test it on a copy and pin your version tag.
What hardware does it need?
Per the quickstart, Linux x86-64 with Docker 24.0.0+ and Compose 2.26.1+, and a recommended start of 4 cores, 16 GB RAM and 50 GB disk, plus a chat and an embedding model.
Does it work with local models?
Yes, through Ollama or vLLM per the Deploy Local Models page, or an OpenAI-API-compatible provider.
Does it support MCP?
It runs an MCP server with three tools (retrieval, list datasets, list chats) and agents can call external MCP servers.
Is it secure?
GitHub lists eight advisories, five critical. Keep it off the public internet, change every default password, turn off public sign-up and update promptly.
Where is cloud data stored?
The public pages do not say; the privacy policy says data may be processed in other countries. Ask before uploading sensitive files.
Is RAGFlow an affiliate product here?
No. This review has no affiliate links.
Where this came from, and when.
Pricing and plans: plan section of ragflow.io, 18 Oct 2026 (ragflow.io/pricing is a not-found page). Terms of Use section 4 on pricing changes.
Product: RAGFlow quickstart, FAQ, release notes, migration guide, configurations, dataset and chat configuration, knowledge compilation, MCP tools, model providers, agent canvas, embedding and code sandbox pages, 18 Oct 2026; the infiniflow/ragflow README; the v1.0.0-rc2 docker/.env, docker-compose.yml and docker-compose-base.yml.
Legal: Terms of Use, Data Processing Agreement and Privacy Policy on ragflow.io, each “Last Updated: 2026-04-23”, as of 18 Oct 2026.
Repository and market: infiniflow/ragflow on GitHub, 18 Oct 2026: 92,402 stars, 11,021 forks, 943 open issues and 418 open pull requests on the page, eight advisories, release history (19, 19 and 18 releases in 2024, 2025 and 2026); 822 PRs merged and 157 issues opened (27 closed) between 18 Sep and 17 Oct 2026; Docker Hub pull count 3,911,816 and tag sizes; ragflow-sdk 16,323 PyPI downloads last month (pypistats); competitor star counts for Dify, Open WebUI, LangChain, AnythingLLM, LlamaIndex and Haystack.
Independent evidence: Hacker News story 39896923 (1 Apr 2024, 230 points, 53 comments) and comments 39900338, 39897959, 39898012, 39900324 (1 Apr 2024), 39901380 and 39903903 (2 Apr 2024); HN item 47754820 (13 Apr 2026); ZeroPath blog post of 9 Apr 2026; GitHub pull requests 13923 and 14091; issues 20559, 20922, 20453, 20377, 20409, 3443, 4406, 6546, 3178 and 2457. No Trustpilot, G2, Capterra or Product Hunt rating exists to quote.
Images: seventeen screenshots of public pages captured on 18 Oct 2026 (RAGFlow home, plan section, quickstart, migration guide, release notes, MCP tools, Terms, DPA and privacy policy; GitHub repository and advisories; Docker Hub; Hacker News; Dify, AnythingLLM, LlamaIndex and DigitalOcean price pages), eight product screenshots and the architecture diagram published by RAGFlow in its documentation and README, labelled as vendor material.
Video: one video from RAGFlow’s official YouTube channel, @InfiniFlow-AI, linked from ragflow.io.
Costs: DigitalOcean droplet prices and OpenAI API prices (text-embedding-3-small $0.02 and gpt-6-luna $0.10 and $0.50 per million tokens), 18 Oct 2026. Workloads in the cost examples are invented and labelled.
JAVIS Fit Score (63/100): an editorial composite scored out of 20 on five criteria. Price clarity 11: cheap, clear tiers, but crossed-out prices, undefined credits and no billing period. Capability breadth 18: strong parsing, hybrid retrieval, compilation, agents, MCP, API and many connectors. Independent evidence 11: a busy, detailed issue tracker and a 2024 launch thread, but no rating and no independent benchmark. Security and data control 9: Apache-2.0 self-hosting, but eight advisories, weak defaults and unfinished legal terms. Cost control and fit 14: free self-hosting and a cheap Starter plan, against a heavy stack and an unfinished 1.0. It is judgment, not a measurement.
What this review does not cover: parsing accuracy, answer quality, ingestion speed or memory use on your documents, the cloud’s actual hosting region and subprocessors, the Enterprise agreement and security addendum, and a technical security review.
