CVE-2026-39413 Details
Description
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.4.14, the LightRAG API is vulnerable to a JWT algorithm confusion attack where an attacker can forge tokens by specifying 'alg': 'none' in the JWT header. Since the jwt.decode() call does not explicitly deny the 'none' algorithm, a crafted token without a signature will be accepted as valid, leading to unauthorized access. This vulnerability is fixed in 1.4.14.
A JWT algorithm confusion vulnerability has been identified in the LightRAG API, prior to version 1.4.14. This issue allows an attacker to forge tokens by specifying 'alg': 'none' in the JWT header. The vulnerability arises because the jwt.decode() function does not explicitly reject the 'none' algorithm, enabling crafted tokens without signatures to be accepted as valid. As a result, attackers can gain unauthorized access to protected resources.
Users are advised to update to LightRAG version 1.4.14 or later. Additionally, when implementing JWT validation, explicitly specify allowed algorithms and exclude 'none'.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/github/advisory-database/issues/7373 | CVE | |
| https://github.com/HKUDS/LightRAG/security/advisories/GHSA-8ffj-4hx4-9pgf | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hkuds lightrag | < 1.4.14 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | CVE Modified | CVE |
| Apr 20, 2026 | Initial Analysis | [email protected] |
| Apr 8, 2026 | New CVE Received | [email protected] |