CVE-2026-51897 in RAGFlow
Summary
by MITRE • 10/02/2026
RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in RAGFlow version 0.24.0 represents a critical failure in server-side access control mechanisms within the evaluation application interface. Specifically, the flaw resides in the get_dataset endpoint located at api/apps/evaluation_app. This component is designed to retrieve dataset information for evaluation purposes but lacks sufficient verification of user permissions before processing requests. The core technical issue stems from an improper authorization check that fails to validate whether the requesting entity has legitimate ownership or administrative privileges over the targeted dataset. Consequently, this oversight allows any authenticated user, and potentially unauthenticated users depending on the specific deployment configuration, to interact with resources they do not own or have permission to access.
From a technical perspective, the absence of robust identity verification enables an attacker to manipulate input parameters associated with the get_dataset function. By crafting malicious requests that target internal dataset identifiers or configurations, an adversary can bypass intended security boundaries. This lack of restrictive controls creates a pathway for unauthorized data retrieval and, more critically, facilitates remote code execution scenarios. The vulnerability aligns closely with CWE-284 Improper Access Control, as it involves the failure to enforce proper rights for users against restricted actions within a software application. Furthermore, this behavior is consistent with MITRE ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate credentials or access patterns to move laterally and execute commands on compromised systems.
The operational impact of this vulnerability is severe due to the potential for attacker-controlled code execution. If an adversary successfully exploits this flaw, they can inject malicious payloads that are processed by the server-side logic handling dataset evaluations. This could lead to full system compromise, allowing the extraction of sensitive data stored within the RAGFlow environment or using the compromised instance as a pivot point for further network attacks. The ability to trigger arbitrary code execution undermines the integrity and confidentiality guarantees provided by the platform, posing significant risks to organizations relying on RAGFlow for secure document processing and retrieval-augmented generation workflows.
Mitigation strategies must focus on implementing strict authorization checks at the application layer before any dataset-related operations are initiated. Developers should ensure that every request to the get_dataset endpoint verifies both user authentication status and explicit permission grants relative to the specific resource ID requested. Implementing role-based access control policies will help restrict actions based on predefined security roles rather than relying solely on input validation. Additionally, applying principle of least privilege ensures that service accounts and application components operate with only the minimum permissions necessary for their function. Regular security audits and penetration testing should be conducted to identify similar gaps in other endpoints within the evaluation_app module. Keeping RAGFlow updated to versions where this access control logic has been corrected is essential for maintaining a secure operational posture against exploitation attempts targeting these specific API routes.