Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

RAGFlow 0.24.0 allows unauthorized code execution via dataset API

CVE-2026-51897 · published 17 days ago
Summary

Version 0.24.0 of RAGFlow does not correctly limit who can call the get_dataset function, so a malicious user could cause the system to run their own code or commands. This could lead to data loss, system compromise, or other unwanted actions. Apply any available patches, upgrade to a newer release, and restrict API access to trusted users only.

Original advisory text
RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution
RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-284Improper Access Control
Timeline
Published1 Oct 2026
Updated15 Oct 2026
First seen1 Oct 2026
Sources
CVE-2026-51897 · NVD
CVE-2026-51897 · MITRE
Track software like this
Free during beta