CVE-2026-61736 Details
Description
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating documents and knowledge graph data or performing destructive actions such as deleting the document store. This vulnerability is fixed in 1.5.4.
A vulnerability in LightRAG prior to version 1.5.4 allows any origin to make credentialed requests to the API, exploiting a misconfiguration of Cross-Origin Resource Sharing (CORS) settings. The server defaulted to CORS_ORIGINS='*' while allowing credentials, which Starlette's CORSMiddleware interpreted as whitelisting all origins for authenticated requests. This flaw enabled malicious websites to access sensitive user data and perform destructive actions within the application.
Users can update to LightRAG version 1.5.4 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3d | [email protected] | Source CodeVendor |
| https://github.com/HKUDS/LightRAG/commit/df68d75f9dc29dd340ffb6794b48f48c4fdc9a2d | [email protected] | Source CodeVendor |
| https://github.com/HKUDS/LightRAG/commit/ebba6548639c0f2e8919100eff76b401f1222252 | [email protected] | Source CodeVendor |
| https://github.com/HKUDS/LightRAG/pull/3317 | [email protected] | Source CodeVendor |
| https://github.com/HKUDS/LightRAG/releases/tag/v1.5.4 | [email protected] | Release NotesVendor |
| https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-942 | Permissive Cross-domain Policy with Untrusted Domains | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HKUDS LightRAG | <= 1.5.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |