External risk intelligence

RAGFlow Improper Access Control Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-51897

RAGFlow is a web-based RAG engine and framework commonly deployed as an internet-facing or intranet-accessible web application to provide API and user interface endpoints for data evaluation and retrieval services, making the application's API endpoints frequently reachable in common deployment patterns.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in RAGFlow, a technology used for retrieval-augmented generation. The flaw, related to access control, could allow unauthorized code or command execution depending on how the system is configured and accessed. While specific impacts are not detailed here, such vulnerabilities can broadly lead to system compromise or data breaches.

Improper access control flaw found in RAGFlow.
Critical severity could allow unauthorized code execution.
Confirm relevance and exposure of RAGFlow systems.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by reaching the `get_dataset` API endpoint without authentication. This endpoint, when accessible externally, can be manipulated to execute arbitrary code or commands on the system. The issue stems from inadequate access controls within the RAGFlow application's evaluation feature, potentially leading to a complete compromise of the affected system if an attacker can access the exposed API.

No authentication required.
Triggered via the `get_dataset` API.
Leads to code or command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in RAGFlow could allow an unauthenticated attacker to execute arbitrary code or commands by interacting with the `get_dataset` API endpoint. This could occur if the application exposes specific data in a way that allows for manipulation of the command execution flow.

System data and service behavior.
Via crafted API requests to `get_dataset`.
Potential for unauthorized code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in RAGFlow's API impacts application owners and platform teams responsible for managing the RAGFlow deployment. The initial step is to identify all instances of RAGFlow, assess their exposure and business criticality, and then assign an owner to coordinate remediation efforts based on the assessed risk.

Application or platform owners should own the issue.
Verify RAGFlow API endpoint accessibility.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is RAGFlow and how is it used?

RAGFlow is an open-source retrieval-augmented generation (RAG) engine designed to build intelligent document processing and search systems. It functions as a web-based framework that enables organizations to evaluate and retrieve information from complex datasets using a combination of web interfaces and API endpoints.

What does CVE-2026-51897 mean in plain English?

This vulnerability is classified as improper access control (CWE-284). In simple terms, the software fails to verify who is allowed to use a specific function. Because the security check is missing, a remote attacker can interact with the evaluation system in unintended ways to run unauthorized code or commands on the underlying host.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending a crafted request to the specific 'get_dataset' API endpoint within the evaluation component. Because the application does not require authentication for this action, the attacker does not need legitimate credentials to interact with it. Requests that do not target this specific endpoint or are blocked by network-level authentication do not trigger the bug.

Is my RAGFlow instance at risk?

According to Halo Surface Signal, RAGFlow is typically deployed as a web application with active API or user interface endpoints, making it a likely target if reachable over the network. If your instance is accessible from the internet or exposed across intranet segments where untrusted users can reach the API, it is at higher risk of being used to reach the affected endpoint.

What should I do to respond to this vulnerability?

First, conduct an inventory to locate all RAGFlow instances within your environment. Verify whether these instances are accessible to external or unauthorized users. Once identified, assign ownership to your technical team to prioritize remediation, such as restricting API access at the network boundary or applying vendor-provided updates once they become available.

References

gist.github.com/Ro1ME/7101a09720c120fd4989705aa7c0b894

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.