PT-2026-60192 · Lightrag · Lightrag

CVE-2026-61736 · Published 2026-07-15 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.5.4

Description An issue exists in the server configuration within the file lightrag/api/lightrag server.py where CORS ORIGINS is set to * and allow credentials is set to True. This configuration causes the Starlette CORSMiddleware to whitelist every origin for credentialed cross-origin requests, bypassing the browser's same-origin policy. Consequently, a malicious website visited by an authenticated user can silently perform authenticated API requests to exfiltrate documents and knowledge graph data or execute destructive actions, such as deleting the document store.

Recommendations Update to version 1.5.4.

Exploit

Fix

Weakness Enumeration

CWE-942

Related Identifiers

CVE-2026-61736

GHSA-6X6H-QQR7-855W

PYSEC-2026-3474

Affected Products

Lightrag

References · 18

• 🔥 https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61736.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-61736 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-61736 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-3474 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6x6h-qqr7-855w · Vendor Advisory
• https://github.com/HKUDS/LightRAG · Note
• https://github.com/HKUDS/LightRAG/commit/df68d75f9dc29dd340ffb6794b48f48c4fdc9a2d · Note
• https://github.com/HKUDS/LightRAG/commit/ebba6548639c0f2e8919100eff76b401f1222252 · Note
• https://github.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3d · Note
• https://github.com/HKUDS/LightRAG/releases/tag/v1.5.4 · Note
• https://github.com/HKUDS/LightRAG/pull/3317 · Note
• https://reddit.com/r/pwnhub/comments/1uxovwu/critical_cors_vulnerability_in_lightrag_allows · Reddit Post
• https://reddit.com/r/pwnhub/comments/1uxmutw/cve_daily_brief_20260716 · Reddit Post
• https://reddit.com/r/pwnhub/comments/1uy3q5e/cve_daily_brief_20260716 · Reddit Post