CVE-2026-61808

LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modify the knowledge graph, cancel pipelines, clear caches, and consume LLM resources. This issue is mitigated in version 1.5.5rc1.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/HKUDS/LightRAG/commit/0bd102401b4b28a02664e5b6af476bf7a4470292
https://github.com/HKUDS/LightRAG/security/advisories/GHSA-mmg5-8x8q-v934
https://github.com/HKUDS/LightRAG/security/advisories/GHSA-mmg5-8x8q-v934

Configurations

No configuration.

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) LightRAG proporciona generación aumentada por recuperación simple y rápida. A través de la versión 1.5.4, el servidor API de LightRAG se enlaza a todas las interfaces de red con la autenticación deshabilitada por defecto, permitiendo a un atacante de red no autenticado leer el contenido de documentos indexados, cargar o eliminar documentos, modificar el grafo de conocimiento, cancelar pipelines, borrar cachés y consumir recursos de LLM. Este problema se mitiga en la versión 1.5.5rc1.

Information

Published : 2026-08-07 20:16

Updated : 2026-10-24 16:10

NVD link : CVE-2026-61808

Mitre link : CVE-2026-61808

CVE.ORG link : CVE-2026-61808

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-61808", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-61808", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-10T12:25:18.310012Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "HKUDS", "product": "LightRAG", "versions": [{"status": "affected", "version": "< 1.5.5rc1"}]}]}], "published": "2026-08-07T20:16:52.007", "references": [{"url": "https://github.com/HKUDS/LightRAG/commit/0bd102401b4b28a02664e5b6af476bf7a4470292", "source": "security-advisories@github.com"}, {"url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-mmg5-8x8q-v934", "source": "security-advisories@github.com"}, {"url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-mmg5-8x8q-v934", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modify the knowledge graph, cancel pipelines, clear caches, and consume LLM resources. This issue is mitigated in version 1.5.5rc1."}, {"lang": "es", "value": "LightRAG proporciona generaci\u00f3n aumentada por recuperaci\u00f3n simple y r\u00e1pida. A trav\u00e9s de la versi\u00f3n 1.5.4, el servidor API de LightRAG se enlaza a todas las interfaces de red con la autenticaci\u00f3n deshabilitada por defecto, permitiendo a un atacante de red no autenticado leer el contenido de documentos indexados, cargar o eliminar documentos, modificar el grafo de conocimiento, cancelar pipelines, borrar cach\u00e9s y consumir recursos de LLM. Este problema se mitiga en la versi\u00f3n 1.5.5rc1."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "security-advisories@github.com"}