Vulnerability · Published Aug 7, 2026 · Assigned by GitHub_M

CVE-2026-61808LightRAG: Missing Authentication for Critical API Functions in Default Configuration

Critical 9.8

In plain English

A critical-severity missing authentication in LightRAG from HKUDS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.5%top 15.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modify the knowledge graph, cancel pipelines, clear caches, and consume LLM resources. This issue is mitigated in version 1.5.5rc1.

Affected products (as reported)

Vendor	Product	Versions
HKUDS	LightRAG	< 1.5.5rc1

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/HKUDS/LightRAG/security/advisories/GHSA-mmg5-8x8q-v934 x_refsource_CONFIRM
https://github.com/HKUDS/LightRAG/commit/0bd102401b4b28a02664e5b6af476bf7a4470292 x_refsource_MISC