PT-2026-30318 · Lightrag · Lightrag

Published 2026-04-04 · Updated 2026-04-05 · CVE-2026-30762

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.4.10

Description A hardcoded JWT signing secret in LightRAG allows authentication bypass, potentially leading to unauthorized access. The default JWT secret 'lightrag-jwt-default-secret' is used if the TOKEN SECRET environment variable is not set. An attacker can forge valid JWT tokens using this known secret and access protected endpoints. The vulnerable code is located in lightrag/api/config.py (line 397) and lightrag/api/auth.py (lines 24-25).

Recommendations Require the TOKEN SECRET environment variable to be explicitly set when authentication is configured. Refuse to start the API server if authentication is enabled but no custom secret is provided.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-30762

GHSA-MCWW-4HXQ-HFR3

Affected Products

Lightrag

References · 4

• https://osv.dev/vulnerability/GHSA-mcww-4hxq-hfr3 · Vendor Advisory
• https://github.com/HKUDS/LightRAG/security/advisories/GHSA-mcww-4hxq-hfr3 · Note
• https://github.com/HKUDS/LightRAG · Note
• https://twitter.com/pulsepatchio/status/2040804069082616273 · Twitter Post