CVE-2026-61736criticalCWE-942

CVE-2026-61736: fallo crítico en HKUDS LightRAG

LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests

Publicada el

Seguir esta CVE+ Monitorear LightRAG+ Monitorear lightrag-hku

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

43Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendcvss 9.3epss 1.4%
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating documents and knowledge graph data or performing destructive actions such as deleting the document store. This vulnerability is fixed in 1.5.4.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Productos afectados
HKUDS · LightRAG
CVEs relacionadas — HKUDS LightRAG

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-61808CRITICALLightRAG: Missing Authentication for Critical API Functions in Default ConfigurationEPSS 2.5%CVE-2026-85734CRITICALLightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force AttacksEPSS 0.6%CVE-2026-61740CRITICALLightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protectionEPSS 0.5%CVE-2026-85725MEDIUMLightRAG: Plaintext Passwords Compared Without Constant-Time FunctionEPSS 0.4%CVE-2026-85709MEDIUMLightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error ResponsesEPSS 0.4%CVE-2026-86062MEDIUMLightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested contentEPSS 0.3%