CVE-2026-61808: LightRAG: Missing Authentication for Critical API Functions in Default Configuration
LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modify the knowledge graph, cancel pipelines, clear caches, and consume LLM resources. This issue is mitigated in version 1.5.5rc1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LightRAG API serverto a version that resolves this vulnerability.Fixed in 1.5.5rc1 - Compensating control
Until upgraded, restrict network access to the LightRAG API server so unauthenticated network attackers cannot reach the API endpoints bound to all interfaces with authentication disabled by default.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61808?
The severity of CVE-2026-61808 is critical with a score of 9.8.
How do I fix CVE-2026-61808?
To fix CVE-2026-61808, ensure that authentication is enabled for the LightRAG API server and restrict its binding to specific network interfaces.
What impact does CVE-2026-61808 have on my system?
CVE-2026-61808 allows unauthenticated attackers to read, upload, modify, or delete documents via the LightRAG API.
Which versions of LightRAG are affected by CVE-2026-61808?
CVE-2026-61808 affects LightRAG versions up to and including 1.5.4.
Is CVE-2026-61808 exploitable over the network?
Yes, CVE-2026-61808 is exploitable over the network due to its default configuration allowing unauthenticated access.