Unauthenticated API Access in LightRAG Server

Executive Summary

CVE-2026-61808 is a vulnerability in the LightRAG API server where the default configuration binds to all network interfaces without authentication. This allows unauthenticated users to access sensitive endpoints, including document uploads, deletions, knowledge graph modifications, cache clearing, and LLM resource consumption.

Useful 0 Not Useful 0

Detection Guidance

Check if the LightRAG API server is running on all network interfaces (0.0.0.0) without authentication. Use commands like 'netstat -tulnp | grep 9621' or 'ss -tulnp | grep 9621' to verify if the server is listening on port 9621 across all interfaces. Inspect server logs for warnings about unauthenticated access or default configurations.

Verify if environment variables like LIGHTRAG_API_KEY or AUTH_ACCOUNTS are set. Check Docker configurations if applicable, as the default Compose setup maps port 9621 to the host network.

Useful 0 Not Useful 0

Impact Analysis

An attacker could read indexed document content, upload or delete documents, modify the knowledge graph, cancel pipelines, clear caches, or consume LLM resources. This could lead to data breaches, unauthorized modifications, or service disruption if the server is exposed to untrusted networks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's confidentiality requirements. Organizations using LightRAG without proper authentication may face compliance violations, legal penalties, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Bind the server to loopback address (127.0.0.1) instead of 0.0.0.0 to restrict access to local use only. Configure authentication using LIGHTRAG_API_KEY or AUTH_ACCOUNTS with TOKEN_SECRET as per the project's documentation.

Update to version 1.5.5rc1 or later, which includes mitigations like startup warnings and improved default security settings. Ensure Docker deployments do not expose port 9621 to untrusted networks without proper firewall rules.

Useful 0 Not Useful 0