LightRAG vulnerabilities

LightRAG through version 1.5.4 has an API server that binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modify the knowledge graph, cancel pipelines, clear caches, and consume LLM resources.

In LightRAG prior to 1.5.4, when LIGHTRAG_API_KEY is set but AUTH_ACCOUNTS is unset, X-API-Key protection can be bypassed. The system falls back to a hardcoded DEFAULT_TOKEN_SECRET, and /auth-status and /login can mint guest JWTs that are accepted before checking the API key. A remote unauthenticated attacker can call guarded endpoints, including document read, upload, deletion, graph mutation, and query endpoints.

LightRAG before version 1.5.4 defaults to CORS_ORIGINS=* combined with allow_credentials=True, causing Starlette CORSMiddleware to whitelist every origin for credentialed cross-origin requests. An attacker can make authenticated API requests from a malicious website, exfiltrating documents and knowledge graph data or performing destructive actions.

LightRAG prior to version 1.4.14 is vulnerable to a JWT algorithm confusion attack where an attacker can forge tokens by specifying 'alg': 'none' in the JWT header. The jwt.decode() call does not explicitly deny the 'none' algorithm, so a crafted token without a signature is accepted as valid, leading to unauthorized access. Fixed in version 1.4.14.