Critical severity · published Jul 15, 2026
CVE-2026-61736
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
9.3
CVSS
1.4%
EPSS
No
On KEV
Description
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating documents and knowledge graph data or performing destructive actions such as deleting the document store. This vulnerability is fixed in 1.5.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
LightRAG · HKUDS
< 1.5.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-61736
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-61736
github.com
https://github.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3d
github.com
https://github.com/HKUDS/LightRAG/commit/df68d75f9dc29dd340ffb6794b48f48c4fdc9a2d
github.com
https://github.com/HKUDS/LightRAG/commit/ebba6548639c0f2e8919100eff76b401f1222252
github.com
https://github.com/HKUDS/LightRAG/pull/3317
github.com
https://github.com/HKUDS/LightRAG/releases/tag/v1.5.4
github.com
https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w
More from LightRAG
9.8
CVE-2026-61808
LightRAG: Missing Authentication for Critical API Functions in Default Configuration
9.3
CVE-2026-61740
LightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
9.1
CVE-2026-85734
LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
7.1
CVE-2026-85740
LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
6.5
CVE-2026-39413
LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG API