CVE-2026-61736

Deferred Deferred - Pending Action

CORS Misconfiguration in LightRAG Server Allows Credentialed Requests

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating documents and knowledge graph data or performing destructive actions such as deleting the document store. This vulnerability is fixed in 1.5.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-61736

EUVD

EUVD-2026-44670

Affected Vendors & Products

Vendor	Product	Version / Range
hkuds	lightrag	to 1.5.4 (inc)
hkuds	lightrag	to 1.5.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-942	The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

Attack-Flow Graph

Executive Summary

This vulnerability in LightRAG (versions <= 1.5.3) involves a default CORS misconfiguration where the server allows all origins (wildcard *) with credentials enabled. This combination lets any malicious website visited by an authenticated user silently make authenticated API requests, potentially stealing data or performing destructive actions like deleting the document store.

Detection Guidance

Check LightRAG server configuration for CORS_ORIGINS set to '*' and allow_credentials=True. Inspect HTTP responses for Access-Control-Allow-Credentials: true with wildcard origins. Use curl commands like curl -I -H 'Origin: https://attacker.com' http://lightrag-server to test CORS headers.

Impact Analysis

If you use LightRAG versions <= 1.5.3, an attacker could trick you into visiting a malicious site. That site could then make authenticated API calls on your behalf, stealing sensitive documents or knowledge graph data, or even deleting your entire document store without your knowledge.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles and HIPAA's security requirements for protecting sensitive health information. It risks unauthorized disclosure of personal or confidential data.

Mitigation Strategies

Upgrade LightRAG to version 1.5.4 or later. If upgrading is not possible, modify CORS_ORIGINS to explicitly list allowed origins and set allow_credentials=False when using wildcard origins. Review and restrict CORS configurations in reverse proxies.

Hi! I’m here to help you understand CVE-2026-61736. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70