Critical severity · published Aug 7, 2026
CVE-2026-61808
LightRAG: Missing Authentication for Critical API Functions in Default Configuration
9.8
CVSS
2.5%
EPSS
No
On KEV
Description
LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modify the knowledge graph, cancel pipelines, clear caches, and consume LLM resources. This issue is mitigated in version 1.5.5rc1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
LightRAG · HKUDS
< 1.5.5rc1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-61808
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-61808
github.com
https://github.com/HKUDS/LightRAG/commit/0bd102401b4b28a02664e5b6af476bf7a4470292
github.com
https://github.com/HKUDS/LightRAG/security/advisories/GHSA-mmg5-8x8q-v934
More from LightRAG
9.3
CVE-2026-61740
LightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
9.3
CVE-2026-61736
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
9.1
CVE-2026-85734
LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
7.1
CVE-2026-85740
LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
6.5
CVE-2026-39413
LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG API