CVE-2026-85709 Details
Description
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text from error handlers in document_routes.py, graph_routes.py, query_routes.py, ollama_api.py, and lightrag_server.py. The detail=str(e), detail=str(exc), and equivalent formatted-message paths expose server filesystem paths, database host, port, user, and database names, language-model provider diagnostics, configuration details, and Python library internals to a network client that can trigger an error. The default unauthenticated configuration makes those responses reachable without credentials, and URI-configured backends can disclose connection strings containing credentials depending on the underlying driver error. This issue is fixed in version 1.5.5.
A vulnerability in the LightRAG API server prior to version 1.5.5 allows raw Python exception messages to be sent in HTTP error responses. This issue is present in several router files and the main server file. The exposed exception details can include sensitive information such as server filesystem paths, database connection details, language model provider diagnostics, and Python library internals. The vulnerability arises from the absence of a global exception handler to sanitize error messages before they reach the client. The default unauthenticated configuration further exacerbates the issue, allowing any network-reachable client to trigger and access these error messages without credentials.
Users can update to LightRAG version 1.5.5 or later, where this vulnerability has been fixed. The update process involves downloading the latest version from the LightRAG repository on GitHub.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 22, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/HKUDS/LightRAG/security/advisories/GHSA-hrmj-7rvj-4hg8 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/HKUDS/LightRAG/commit/4d90a0eb35d40b45f3a9045e308ec126897a3364 | [email protected] | Source CodeVendor |
| https://github.com/HKUDS/LightRAG/commit/dcab315d7dc1eea682e9b2c4fcb1b06474484c47 | [email protected] | Source CodeVendor |
| https://github.com/HKUDS/LightRAG/pull/3422 | [email protected] | Issue TrackingVendor |
| https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5 | [email protected] | Release NotesVendor |
| https://github.com/HKUDS/LightRAG/security/advisories/GHSA-hrmj-7rvj-4hg8 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-209 | Generation of Error Message Containing Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HKUDS LightRAG | <= 1.5.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 22, 2026 | New CVE Received | [email protected] |