CVE-2026-61808
CriticalCVSS 9.8Summary
LightRAG through version 1.5.4 has an API server that binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modify the knowledge graph, cancel pipelines, clear caches, and consume LLM resources.
Risk Assessment
An unauthenticated attacker can access sensitive data and disrupt service, potentially leading to confidentiality and integrity breaches.
Recommendation
Upgrade LightRAG to version 1.5.5rc1 or later, which mitigates the issue.
Original NVD description (English source)
LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modify the knowledge graph, cancel pipelines, clear caches, and consume LLM resources. This issue is mitigated in version 1.5.5rc1.