No fixed build or workaround is published yet. Limit exposure and watch for a patch.
Steps
Written by AI from the record
Check which RAGFlow version you run (and confirm whether it is 0.24.0 or earlier).
If you are on 0.24.0 or earlier, assume risk if you have any user accounts beyond a fully trusted admin (because a normal authenticated user can trigger the bug).
Immediately restrict access to RAGFlow: limit who can log in, and disable or strongly restrict features that let users create/trigger Canvas workflows and prompt generator steps.
If you can’t upgrade (no fixed version is provided), isolate the RAGFlow server from the rest of your network and limit inbound access to only the IPs/users who need it.
Collect and review server logs for evidence of suspicious template/prompt activity and unexpected process execution around the time of any suspicious logins or workflow runs.
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In 0.24.0 and earlier, a Jinja2 template injection in the prompt generator (rag/prompts/generator.py) allows any authenticated user to execute arbitrary OS commands on the server. Any normal user can register, create a Canvas workflow with a DuckDuckGo + LLM component chain, and trigger the SSTI.
In plain language
Written by AI from the record
CVE-2026-45312 is a serious bug in RAGFlow (versions 0.24.0 and earlier) that can let a normal logged-in user run commands on your server; if you use RAGFlow with any user accounts that can create or trigger prompt/Canvas workflows, you should treat this as an urgent fix—even though a public patch isn’t available.
In RAGFlow (ragflow) versions 0.24.0 and earlier, a Server-Side Template Injection in the prompt generator (Jinja2 prompt handling) can be triggered by an authenticated user via prompt/Canvas workflow creation and execution, leading to Remote Code Execution on the server; exploitation is reported with actor Qilin and is driving rising press attention.
If you're affected
Full server compromise
Data theft from the server
Service disruption or shutdown
Malicious actions under your account
What is it
RAGFlow is software that helps applications answer questions using retrieved content (a “RAG” system). This bug is like leaving a “template” door unlocked inside the prompt builder—so a logged-in user can trick the system into running operating-system commands on the machine instead of only generating text. If someone gets a normal account, they may be able to take over the server where RAGFlow runs.
Who is affected
This matters if you run RAGFlow (ragflow) version 0.24.0 or earlier and you allow any authenticated users to create or trigger Canvas workflows that use the prompt generator. A normal user account is enough; you don’t need admin access. This is a real risk when the vulnerable prompt generator path is reachable through your app’s authenticated workflow/prompt execution features—especially given reported exploitation activity.
How urgent is it
This is RED because reported exploitation activity is associated with actor Qilin and attention is rising, meaning attackers are actively trying this rather than it being theoretical. With no fixed patch information available, your immediate priority is to reduce who can reach the vulnerable workflow/prompt execution paths and limit exposure until a real fix is provided.
What to do — in detail
Confirm exposure (version check)
On the RAGFlow host (or in your deployment config), identify the exact RAGFlow version.
Mark “at-risk” if the version is 0.24.0 or earlier.
trigger workflow runs that go through the prompt generator.
If yes, treat your environment as reachable for this issue.
Immediate mitigation if you are on 0.24.0 or earlier (patch not yet known)
Restrict login access:
Disable new user registration if you have that option.
Remove or disable unused accounts.
Ensure only fully trusted admins can access workflow creation/run features.
Restrict workflow capability:
Disable or tightly control Canvas workflow creation/execution for non-admin roles.
If there are feature flags, admin-only toggles, or role permissions, set prompt/workflow-triggering actions to admin-only.
Network isolation and inbound limiting:
Do not expose RAGFlow broadly to the internet.
Restrict inbound traffic (reverse proxy rules, IP allowlists) to the smallest possible set of users/systems.
Hunt for signs of compromise (evidence-based)
Review RAGFlow application logs for unusual workflow executions, repeated prompt/template errors, or prompt generator anomalies.
Review web/app access logs for suspicious logins followed quickly by workflow runs.
If you have host-level logs/EDR, look for unexpected spawned processes or command execution attempts around the time of suspicious requests.
Recovery precautions (if you find evidence)
Assume the attacker may have acted beyond RCE (data access, credential theft, persistence).
Preserve logs for forensics.
Rotate any secrets used by the RAGFlow service (API keys, database credentials) and tokens used by connected systems.
Track for a real fix
No fixed version information was available in the provided references. Keep monitoring for an official patch release for RAGFlow and plan an upgrade as soon as one is published.
What to monitor after mitigation
Account creation and privilege changes.
Canvas workflow creation/run events by user.
Sudden spikes in errors or template/prompt-related exceptions.
Any unexpected outbound network access from the RAGFlow host.
Technical context
Severity is critical (reported as CRITICAL) with a mechanism consistent with CWE-1336 (Server-Side Template Injection). In RAGFlow versions 0.24.0 and earlier, the prompt generator uses Jinja2-style templating and can be manipulated so that an authenticated user can achieve Remote Code Execution by injecting a malicious template payload through the prompt/workflow generation path. KEV is not listed in CISA KEV, and there is no public exploit code on record; however, exploitation is reported with rising press attention and an associated actor (Qilin). EPSS is a low predicted likelihood and flat trend, but that does not override the exploitation signal from the findings.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
