PT-2026-31285 · Lightrag · Lightrag

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-39413

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.4.14

Description The LightRAG API is susceptible to a JWT algorithm confusion attack. An attacker can forge tokens by setting 'alg': 'none' in the JWT header. The jwt.decode() function does not explicitly disallow the 'none' algorithm, allowing a crafted token without a signature to be accepted as valid, resulting in unauthorized access. The vulnerable code is located in lightrag/api/auth.py at line 128, within the validate token method. An attacker can create a JWT with the 'alg' set to 'none' and successfully authenticate, potentially impersonating any user, including administrators, and gaining access to protected resources.

Recommendations Update to LightRAG version 1.4.14 or later. Explicitly specify allowed algorithms in the validate token method, excluding 'none'. Alternatively, hardcode the expected algorithm(s), such as 'HS256'.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-39413

GHSA-8FFJ-4HX4-9PGF

Affected Products

Lightrag

References · 8

• https://github.com/HKUDS/LightRAG/security/advisories/GHSA-8ffj-4hx4-9pgf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39413 · Security Note
• https://osv.dev/vulnerability/GHSA-8ffj-4hx4-9pgf · Vendor Advisory
• https://github.com/HKUDS/LightRAG/commit/728f2e54509d93e0a44f929c7f83f2c88d6d291b · Note
• https://github.com/HKUDS/LightRAG · Note
• https://github.com/github/advisory-database/issues/7373 · Note
• https://reddit.com/r/VulnMatter/comments/1sft88v/resumen_diario_de_vulnerabilidades_08042026 · Reddit Post
• https://twitter.com/VulmonFeeds/status/2041993426728604044 · Twitter Post