CVE-2026-61736
Published:July 15, 2026
Updated:August 04, 2026
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating documents and knowledge graph data or performing destructive actions such as deleting the document store. This vulnerability is fixed in 1.5.4.
Affected Packages
https://github.com/HKUDS/LightRAG.git (GITHUB):
Affected version(s) >=v1.2.1 <v1.5.4Fix Suggestion:
Update to version v1.5.4lightrag-hku (PYTHON):
Affected version(s) >=0.0.0 <1.5.4Fix Suggestion:
Update to version 1.5.4lightrag-hku (PYTHON):
Affected version(s) >=1.2.1 <1.5.4Fix Suggestion:
Update to version 1.5.4Related Resources (11)
Do you need more information?
Contact UsCVSS v4
Base Score:
9.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
NONE
Subsequent System Confidentiality
HIGH
Subsequent System Integrity
HIGH
Subsequent System Availability
NONE
CVSS v3
Base Score:
9.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE
Weakness Type (CWE)
Permissive Cross-domain Security Policy with Untrusted Domains
EPSS
Base Score:
0.30