CVE-2026-85709
Deferred Deferred - Pending Action

Information Disclosure in LightRAG API Server

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text from error handlers in document_routes.py, graph_routes.py, query_routes.py, ollama_api.py, and lightrag_server.py. The detail=str(e), detail=str(exc), and equivalent formatted-message paths expose server filesystem paths, database host, port, user, and database names, language-model provider diagnostics, configuration details, and Python library internals to a network client that can trigger an error. The default unauthenticated configuration makes those responses reachable without credentials, and URI-configured backends can disclose connection strings containing credentials depending on the underlying driver error. This issue is fixed in version 1.5.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-10-12
AI Q&A
2026-09-22
EPSS Evaluated
2026-10-11
NVD
CVE-2026-85709
EUVD
EUVD-2026-84545

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
hkuds lightrag to 1.5.5 (exc)
lightrag lightrag to 1.5.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a sensitive information exposure issue in the LightRAG API server. It occurs because raw Python exception messages containing internal details like filesystem paths, database credentials, server configuration, and Python library internals are directly included in HTTP error responses such as 500 or 422 status codes. This happens across multiple API endpoints and is exacerbated by the default unauthenticated configuration, allowing any network client to trigger and view these errors without authentication.

Detection Guidance

Check LightRAG API server responses for HTTP 500 or 422 errors containing sensitive details like filesystem paths, database credentials, or Python stack traces. Monitor server logs for unhandled exceptions being logged server-side.

Impact Analysis

The impact includes confidentiality breaches where sensitive data like database credentials, server paths, or configuration details are exposed. This could aid follow-on attacks or enable direct database access if the database is network-reachable. The vulnerability also risks leaking language model provider diagnostics and Python internals, potentially aiding attackers in crafting further exploits.

Compliance Impact

This vulnerability likely violates compliance requirements under GDPR and HIPAA due to unauthorized exposure of sensitive data such as database credentials and server configurations. GDPR mandates protection of personal data, while HIPAA requires safeguarding protected health information. The leakage of such details could result in regulatory penalties and legal consequences for affected organizations.

Mitigation Strategies

Upgrade LightRAG to version 1.5.5 or later. Ensure all error handlers use sanitized responses and implement a global exception handler to prevent raw exception leakage. Review server logs for past exposure of sensitive data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85709. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart