CVE-2026-61736criticalCWE-942

CVE-2026-61736: critical vulnerability in HKUDS LightRAG

LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests

Published

Follow this CVE+ Monitor LightRAG+ Monitor lightrag-hku

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.3epss 1.4%
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating documents and knowledge graph data or performing destructive actions such as deleting the document store. This vulnerability is fixed in 1.5.4.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected products
HKUDS · LightRAG
Related CVEs — HKUDS LightRAG

In the same product, most dangerous first.

CVE-2026-61808CRITICALLightRAG: Missing Authentication for Critical API Functions in Default ConfigurationEPSS 2.5%CVE-2026-85734CRITICALLightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force AttacksEPSS 0.6%CVE-2026-61740CRITICALLightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protectionEPSS 0.5%CVE-2026-85725MEDIUMLightRAG: Plaintext Passwords Compared Without Constant-Time FunctionEPSS 0.4%CVE-2026-85709MEDIUMLightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error ResponsesEPSS 0.4%CVE-2026-86062MEDIUMLightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested contentEPSS 0.3%