CVE-2026-61740

Deferred Deferred - Pending Action

Authentication Bypass in LightRAG via Hardcoded JWT Secret

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, when LightRAG is deployed with LIGHTRAG_API_KEY set but AUTH_ACCOUNTS unset, X-API-Key protection can be bypassed because lightrag/api/auth.py falls back to a hardcoded DEFAULT_TOKEN_SECRET, /auth-status and /login can mint guest JWTs, and combined_dependency in lightrag/api/utils_api.py accepts a valid guest token before checking the API key. A remote unauthenticated attacker can call endpoints guarded by combined_auth, including document read, upload, deletion, graph mutation, and query endpoints. This vulnerability is fixed in 1.5.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-61740

EUVD

EUVD-2026-44671

Affected Vendors & Products

Vendor	Product	Version / Range
hkuds	lightrag	1.5.4
hkuds	lightrag	to 1.5.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

Executive Summary

This is an authentication bypass vulnerability in LightRAG versions before 1.5.4. When deployed with LIGHTRAG_API_KEY set but AUTH_ACCOUNTS unset, guest tokens could bypass X-API-Key protection. The combined_dependency function accepted valid guest tokens before checking the API key, allowing unauthenticated attackers to access protected endpoints like document read, upload, deletion, and query operations.

Detection Guidance

Check LightRAG version with 'pip show lightrag' or 'lightrag --version'. If version is below 1.5.4, the system is vulnerable. Inspect environment variables for 'LIGHTRAG_API_KEY' set and 'AUTH_ACCOUNTS' unset. Monitor logs for unauthorized access attempts to endpoints like /auth-status, /login, or protected API routes.

Impact Analysis

An attacker could gain unauthorized access to sensitive data, manipulate knowledge graphs, delete documents, upload malicious files, clear caches, or execute queries that consume paid LLM credits. This occurs without needing the required API key, despite the system being configured for API-key-only authentication.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Unauthorized document access, file uploads, or data deletions may result in data breaches, triggering compliance violations and potential legal penalties.

Mitigation Strategies

Upgrade LightRAG to version 1.5.4 or later immediately. Ensure LIGHTRAG_API_KEY is set and AUTH_ACCOUNTS is properly configured. Remove any hardcoded DEFAULT_TOKEN_SECRET references. Restrict network access to LightRAG instances and monitor for suspicious activity.

Hi! I’m here to help you understand CVE-2026-61740. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70