CVE-2026-61740 Details
Description
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, when LightRAG is deployed with LIGHTRAG_API_KEY set but AUTH_ACCOUNTS unset, X-API-Key protection can be bypassed because lightrag/api/auth.py falls back to a hardcoded DEFAULT_TOKEN_SECRET, /auth-status and /login can mint guest JWTs, and combined_dependency in lightrag/api/utils_api.py accepts a valid guest token before checking the API key. A remote unauthenticated attacker can call endpoints guarded by combined_auth, including document read, upload, deletion, graph mutation, and query endpoints. This vulnerability is fixed in 1.5.4.
An authentication bypass vulnerability has been identified in LightRAG versions through 1.4.15, when deployed with the LIGHTRAG_API_KEY set but AUTH_ACCOUNTS unset. In this configuration, the X-API-Key protection can be bypassed, allowing remote unauthenticated attackers to access endpoints guarded by combined_auth. This includes document read, upload, deletion, graph mutation, and query endpoints. The vulnerability arises because the application falls back to a hardcoded DEFAULT_TOKEN_SECRET, which can be exploited to mint guest JWTs that bypass the API key requirement.
Users should update to LightRAG version 1.5.4 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/HKUDS/LightRAG/security/advisories/GHSA-f4vv-55c2-5789 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/HKUDS/LightRAG/commit/f7819aa3a49a9d8d92eed8251d82d6ebcafa8cba | [email protected] | Source CodeVendor |
| https://github.com/HKUDS/LightRAG/pull/3319 | [email protected] | Issue TrackingVendor |
| https://github.com/HKUDS/LightRAG/releases/tag/v1.5.4 | [email protected] | Release NotesVendor |
| https://github.com/HKUDS/LightRAG/security/advisories/GHSA-f4vv-55c2-5789 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-798 | Use of Hard-coded Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LightRAG | <= 1.4.15 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |