CVE-2026-61808: CWE-306: Missing Authentication for Critical Function in HKUDS LightRAG
CVE-2026-61808 is a critical vulnerability in HKUDS LightRAG through version 1.5.4 where the API server binds to all network interfaces with authentication disabled by default. This allows unauthenticated network attackers to perform unauthorized actions such as reading indexed documents, uploading or deleting documents, modifying the knowledge graph, canceling pipelines, clearing caches, and consuming LLM resources. The issue is mitigated starting in version 1.5.5rc1.
AI Analysis
Technical Summary
LightRAG versions up to 1.5.4 have a missing authentication control on critical functions of the API server, which listens on all network interfaces without requiring authentication by default. This CWE-306 vulnerability permits unauthenticated attackers to access and manipulate sensitive data and system functions remotely. The vulnerability has a CVSS 3.1 score of 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is addressed in version 1.5.5rc1.
Potential Impact
An unauthenticated remote attacker can read sensitive indexed document content, upload or delete documents, modify the knowledge graph, cancel running pipelines, clear caches, and consume large language model resources, potentially leading to data exposure, data loss, service disruption, and resource exhaustion.
Mitigation Recommendations
Upgrade to LightRAG version 1.5.5rc1 or later where authentication is enabled by default on the API server. Until upgrade, restrict network access to the API server to trusted hosts only to reduce exposure.
CVE-2026-61808: CWE-306: Missing Authentication for Critical Function in HKUDS LightRAG
Description
CVE-2026-61808 is a critical vulnerability in HKUDS LightRAG through version 1.5.4 where the API server binds to all network interfaces with authentication disabled by default. This allows unauthenticated network attackers to perform unauthorized actions such as reading indexed documents, uploading or deleting documents, modifying the knowledge graph, canceling pipelines, clearing caches, and consuming LLM resources. The issue is mitigated starting in version 1.5.5rc1.
CVSS v3.1
Score 9.8critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
LightRAG versions up to 1.5.4 have a missing authentication control on critical functions of the API server, which listens on all network interfaces without requiring authentication by default. This CWE-306 vulnerability permits unauthenticated attackers to access and manipulate sensitive data and system functions remotely. The vulnerability has a CVSS 3.1 score of 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is addressed in version 1.5.5rc1.
Potential Impact
An unauthenticated remote attacker can read sensitive indexed document content, upload or delete documents, modify the knowledge graph, cancel running pipelines, clear caches, and consume large language model resources, potentially leading to data exposure, data loss, service disruption, and resource exhaustion.
Mitigation Recommendations
Upgrade to LightRAG version 1.5.5rc1 or later where authentication is enabled by default on the API server. Until upgrade, restrict network access to the API server to trusted hosts only to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-10T20:17:57.991Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a772657bf8831d539846b96
Added to database: 08/08/2026, 12:51:35 UTC
Last enriched: 08/08/2026, 12:52:19 UTC
Last updated: 08/09/2026, 02:10:02 UTC
Views: 15
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.