TI-2026-44184 Aliases CVE-2026-61740 GHSA-f4vv-55c2-5789

Improper authentication in HKUDS LightRAG

HIGH 81CWE-287Published 2026-07-15 · Updated 2026-07-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, when LightRAG is deployed with LIGHTRAG_API_KEY set but AUTH_ACCOUNTS unset, X-API-Key protection can be bypassed because lightrag/api/auth.py falls back to a hardcoded DEFAULT_TOKEN_SECRET, /auth-status and /login can mint guest JWTs, and combined_dependency in lightrag/api/utils_api.py accepts a valid guest token before checking the API key. A remote unauthenticated attacker can call endpoints guarded by combined_auth, including document read, upload, deletion, graph mutation, and query endpoints. This vulnerability is fixed in 1.5.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00509 43rd percentileScored 2026-11-07

Fix Fixed LightRAG (HKUDS): 1.5.4lightrag-hku (PyPI): 1.5.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
HKUDS	LightRAG	before 1.5.4	1.5.4	Patch available	CNA
—	lightrag-hku (PyPI)	before 1.5.4	1.5.4	Patch available	GHSA-f4vv-55c2-5789

LightRAG VendorHKUDS Affected before 1.5.4 Fixed in 1.5.4 Patch available CNA
lightrag-hku (PyPI) Vendor— Affected before 1.5.4 Fixed in 1.5.4 Patch available GHSA-f4vv-55c2-5789

Remediation

Fix · CNA LightRAG (HKUDS) Fixed in 1.5.4
Fix · GHSA-f4vv-55c2-5789 lightrag-hku (PyPI) Fixed in 1.5.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-61740
2026-10-03 Alias added: GHSA-f4vv-55c2-5789
2026-10-06 EPSS moved to the 50th–90th percentile
2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-61740

Other 5

TI-2026-44237 LightRAG: Missing Authentication for Critical API Functions in Default Configuration CVSS 3.1CRITICAL 9.8
TI-2026-78721 Missing authentication in HKUDS Vibe-Trading FastAPI server enables RCE CVSS 4.0CRITICAL 9.3
TI-2026-26034 Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling CVSS 4.0HIGH 8.9
TI-2026-62432 HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool CVSS 4.0CRITICAL 9.2
TI-2026-25310 DeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.py CVSS 4.0HIGH 8.7
TI-2026-27692 nanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge (CVE-2026-2577 Fix Update) CVSS 3.1CRITICAL 9.3

See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences