CVE-2026-51895

Executive Summary

CVE-2026-51895 is an improper access control vulnerability in Ragflow version 0.24.0 and prior, located within the update_metadata_setting function in api/apps/kb_app.py. An attacker who can reach the exposed entry point may perform unauthorized cross-session or privilege-crossing operations against the knowledge base application. No public proof-of-concept, exploit code, or Nuclei template is currently available, and the vulnerability remains unpatched as of this report.

Technical Analysis

Ragflow is an open-source Retrieval-Augmented Generation (RAG) engine that exposes knowledge base management functionality through a web-facing API. The vulnerability resides in the update_metadata_setting function defined in api/apps/kb_app.py, which handles metadata configuration for knowledge bases.

The NVD description classifies this as improper access control — meaning the function fails to adequately verify that the requesting principal is authorized to modify the metadata settings it targets. The description explicitly notes that "depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations."

Two distinct impact patterns are implied:

1. Cross-session operations — an attacker operating within their own authenticated session can manipulate metadata settings belonging to a different session or tenant, indicating an object-level authorization (IDOR-like) failure where the target resource identifier is not bound to the caller's identity.
2. Privilege-crossing operations — a lower-privileged user can invoke the function to alter settings that should require elevated privileges, indicating a function-level authorization failure.

The root cause is consistent with CWE-284 (Improper Access Control): the endpoint likely relies on the presence of an authenticated session without verifying ownership of, or sufficient privilege over, the targeted metadata resource. Because metadata settings frequently govern how documents are indexed, retrieved, and surfaced in RAG pipelines, unauthorized modification can corrupt retrieval integrity or expose data across tenants.

No further code-level detail (parameter names, request schema, or validation logic) is available from the provided intelligence, and none is inferred here.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (improper access control on a web API function) and the NVD description.

1. Reconnaissance / Target Identification. An attacker identifies an internet- or network-exposed Ragflow instance running version 0.24.0 or prior. The knowledge base API surface under api/apps/kb_app.py is the relevant attack surface. Attackers may enumerate accessible knowledge base identifiers through normal application usage or by observing API responses.

2. Triggering the Flaw. The attacker authenticates at whatever privilege level is available (including a low-privileged account), then invokes the update_metadata_setting functionality while supplying a target resource identifier that does not belong to their session or exceeds their privilege level. Because the function does not properly enforce authorization, the request is processed.

3. Execution Method (class level). This is not a code-execution or injection vulnerability. The "payload" is an unauthorized state-changing API request that writes attacker-controlled metadata settings. The attack succeeds purely through missing authorization checks — no memory corruption, injection string, or shell payload is involved.

4. Post-Exploitation Impact. Successful exploitation results in cross-session or privilege-crossing modification of knowledge base metadata. Depending on what the metadata settings control, consequences include tampering with retrieval behavior, poisoning of RAG results, or unauthorized alteration of another tenant's/user's configuration. The description does not establish confidentiality or availability impact beyond configuration integrity.

Impact Assessment

Ragflow is typically deployed as a shared knowledge management and RAG service, often serving multiple users, teams, or tenants. An improper access control flaw in a metadata-setting function therefore carries a multi-tenant blast radius: one actor can affect resources outside their authorization boundary.

• Integrity: High — unauthorized modification of metadata settings.
• Confidentiality: Potentially High — cross-session access may expose or alter settings tied to other users' data.
• Availability: No direct availability impact established by the description.
• Privilege requirement: The description implies the attacker must reach the exposed entry, suggesting at least some level of access is required. The CVSS vector provided in the metadata reflects network reachability, low attack complexity, and low privileges required (AV:N/AC:L/PR:L/UI:N).

The official CVSS score is N/A (not assigned). No EPSS score has been published by FIRST.org, and CVE-2026-51895 is not listed in CISA KEV. No exploit-in-the-wild evidence currently exists.

Detection Guidance

Sigma Rule

title: Ragflow Unauthorized Metadata Setting Modification (CVE-2026-51895)
id: 8f3c1a72-9d4e-4b21-8c77-ragflow51895
status: experimental
description: Detects access to the Ragflow knowledge base metadata setting endpoint indicative of improper access control exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-51895
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: ragflow
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/kb_app.py'
      - 'update_metadata_setting'
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'PATCH'
  condition: selection_endpoint and selection_method
falsepositives:
  - Legitimate administrative metadata updates
level: medium

YARA Rule

rule CVE_2026_51895_Ragflow_Access_Control
{
    meta:
        description = "Detects Ragflow source referencing vulnerable update_metadata_setting function"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-51895"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $fn  = "update_metadata_setting" ascii wide
        $path = "kb_app.py" ascii wide

    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-51895 Ragflow update_metadata_setting Unauthorized Access Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"update_metadata_setting"; nocase; http.uri; content:"kb_app"; nocase; classtype:attempted-user; reference:cve,2026-51895; sid:202651895; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and
      http.request.method in ("POST","PUT","PATCH") and
      stringContains(http.request.path, "kb_app") ]
  [ network where network.protocol == "http" and
      stringContains(url.path, "update_metadata_setting") ]

Splunk SPL Query

index=web OR index=proxy
| search (uri_path="*update_metadata_setting*" OR uri_path="*kb_app*")
| where http_method IN ("POST","PUT","PATCH")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri_path) as paths by src_ip, user_agent
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,ragflow,">
  <rule id="202651895" level="7">
    <decoded_as>web-accesslog</decoded_as>
    <url>update_metadata_setting</url>
    <description>CVE-2026-51895: Suspicious Ragflow metadata setting modification request</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Ragflow 0.24.0 and prior are affected, and no vendor fix has been identified.

1) Immediate mitigations

• Restrict network exposure of the Ragflow API and the knowledge base application endpoints to trusted networks only. Do not expose api/apps/kb_app.py-backed routes to the public internet.
• Require authentication for all knowledge base endpoints and, where possible, enforce role-based checks at the reverse proxy or API gateway layer.
• Audit access logs for calls to metadata-setting functionality and investigate any requests originating from low-privileged accounts targeting resources outside their ownership.
• Apply least-privilege to all Ragflow accounts; avoid granting broad knowledge base administrative rights.

2) Patch / upgrade steps

• Monitor the Ragflow project repository and vendor channels for an official security release addressing update_metadata_setting authorization. As no patch exists, no fixed version can currently be recommended.
• Track NVD (CVE-2026-51895) for updates to the reference set and CVSS assignment.
• When a fix is released, test in a staging environment before upgrading production instances.

3) Long-term hardening

• Implement server-side object-level and function-level authorization checks as a standard practice across all state-changing API endpoints.
• Adopt a formal vulnerability disclosure and patch cadence for self-hosted RAG platforms.
• Deploy application-layer monitoring (Sigma/Suricata/Wazuh rules above) to detect authorization-abuse patterns persistently, including after patching.

References

1. NVD — CVE-2026-51895: https://nvd.nist.gov/vuln/detail/CVE-2026-51895
2. Ragflow project repository (source of api/apps/kb_app.py): https://github.com/infiniflow/ragflow
3. CWE-284: Improper Access Control — https://cwe.mitre.org/data/definitions/284.html
4. MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-51895 NOT listed as of this report)

No public threat actor campaigns or exploit-in-the-wild evidence have been identified for CVE-2026-51895 at the time of writing.