LightRAG versions up to and including 1.5.4 have a missing authentication mechanism on the API server, which listens on all network interfaces by default without requiring authentication. This lack of access control enables unauthenticated remote attackers to access and manipulate critical functions including document content retrieval, document management, knowledge graph modification, pipeline cancellation, cache clearing, and resource consumption. The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function). A mitigation is available in version 1.5.5rc1.

An unauthenticated remote attacker can fully interact with the LightRAG API server, leading to complete compromise of data confidentiality, integrity, and availability. This includes unauthorized reading of sensitive indexed documents, unauthorized modification or deletion of documents, alteration of the knowledge graph, disruption of processing pipelines, clearing of caches, and exhaustion of large language model (LLM) resources. The CVSS v3.1 base score is 9.8 (critical), reflecting the high impact and ease of exploitation.

Upgrade to LightRAG version 1.5.5rc1 or later, where authentication is enabled by default on the API server. Until the upgrade is applied, restrict network access to the API server to trusted hosts only to reduce exposure. Patch status is not explicitly confirmed as 'official-fix' but the vendor has released a mitigating version 1.5.5rc1.