Medium severity · published Apr 8, 2026
CVE-2026-39413
LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG API
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.4.14, the LightRAG API is vulnerable to a JWT algorithm confusion attack where an attacker can forge tokens by specifying 'alg': 'none' in the JWT header. Since the jwt.decode() call does not explicitly deny the 'none' algorithm, a crafted token without a signature will be accepted as valid, leading to unauthorized access. This vulnerability is fixed in 1.4.14.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
LightRAG · HKUDS
< 1.4.14 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-39413
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-39413
Exploit
https://github.com/HKUDS/LightRAG/security/advisories/GHSA-8ffj-4hx4-9pgf
github.com
https://github.com/github/advisory-database/issues/7373
More from LightRAG
9.8
CVE-2026-61808
LightRAG: Missing Authentication for Critical API Functions in Default Configuration
9.3
CVE-2026-61740
LightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
9.3
CVE-2026-61736
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
9.1
CVE-2026-85734
LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
7.1
CVE-2026-85740
LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard