by Kastro
Paper/Archive/CVE-2026-61736

CVE-2026-61736

HKUDS LightRAG — LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests

EPSS 1%CVSS 9.3
critical.is priorityof 100
43
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 72.9.729 × 2014.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating documents and knowledge graph data or performing destructive actions such as deleting the document store. This vulnerability is fixed in 1.5.4.

Affected

ProductAffectedFixed inSource
LightRAG< 1.5.4–CNA

Scores by source

GitHub_M (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

exploitgithub.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855wrefgithub.com/HKUDS/LightRAG/pull/3317refgithub.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3drefgithub.com/HKUDS/LightRAG/commit/df68d75f9dc29dd340ffb6794b48f48c4fdc9a2drefgithub.com/HKUDS/LightRAG/commit/ebba6548639c0f2e8919100eff76b401f1222252refgithub.com/HKUDS/LightRAG/releases/tag/v1.5.4