PT-2026-30318 · Pypi · Hkuds Lightrag

Published

2026-04-04

·

Updated

2026-04-04

·

CVE-2026-30762

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary: The file lightrag/api/config.py (line 397) uses a default JWT secret "lightrag-jwt-default-secret" when the TOKEN SECRET environment variable is not set. The AuthHandler in lightrag/api/auth.py (lines 24-25) uses this secret to sign and verify tokens. An unauthenticated attacker can forge valid JWT tokens using the publicly known default secret and gain access to any protected endpoint.
Reproduction:
  1. Install LightRAG v1.4.10 with AUTH ACCOUNTS configured but no TOKEN SECRET set
  2. Use PyJWT to sign a token: jwt.encode({"sub": "admin", "role": "user"}, "lightrag-jwt-default-secret", algorithm="HS256")
  3. Send a request to any protected endpoint with the header: Authorization: Bearer
  4. Access is granted without valid credentials
Suggested Fix: Require TOKEN SECRET to be explicitly set when AUTH ACCOUNTS is configured. Refuse to start the API server if authentication is enabled but no custom secret is provided.
Venkata Avinash Taduturi taduturivenkata@gmail.com

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-30762
GHSA-MCWW-4HXQ-HFR3

Affected Products

Hkuds Lightrag