HKUDS LightRAG up to 1.5.3 CORS lightrag_server.py CORS_ORIGINS/allow_credentials cross-domain policy

Summaryinfo

A vulnerability labeled as problematic has been found in HKUDS LightRAG up to 1.5.3. This issue affects some unknown processing of the file lightrag/api/lightrag_server.py of the component CORS. The manipulation of the argument CORS_ORIGINS/allow_credentials results in cross-domain policy. This vulnerability is cataloged as CVE-2026-61736. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in HKUDS LightRAG up to 1.5.3. It has been classified as problematic. Affected is an unknown part of the file lightrag/api/lightrag_server.py of the component CORS. The manipulation of the argument CORS_ORIGINS/allow_credentials with an unknown input leads to a cross-domain policy vulnerability. CWE is classifying the issue as CWE-942. The product uses a cross-domain policy file that includes domains that should not be trusted. This is going to have an impact on confidentiality. CVE summarizes:

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating documents and knowledge graph data or performing destructive actions such as deleting the document store. This vulnerability is fixed in 1.5.4.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-61736 since 07/10/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

Upgrading to version 1.5.4 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• HKUDS

Name

• LightRAG

Version

• 1.5.0
• 1.5.1
• 1.5.2
• 1.5.3

Website

• Product: https://github.com/HKUDS/LightRAG/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion