LightRAG <= 1.5.3 - Credentialed CORS Wildcard

highseverity

9.3CVSS score

1.4%likelihood of exploitation, next 30 days

73%of all CVEs are less likely

Readycheck to confirm it

LightRAG <= 1.5.4 contains a broken access control vulnerability caused by default CORS_ORIGINS=* with allow_credentials=True in lightrag_server.py, letting malicious websites perform authenticated API requests, exploit requires authenticated user.

Impact

Malicious websites can perform authenticated API requests to exfiltrate or delete data, leading to data loss and information disclosure.

Fix

Update to version 1.5.4 or later.

How to confirm it

Send: GET /
Positive when: status_code == 200 and contains_any(tolower(body), "lightrag", "light-rag", "knowledge graph")
Send: OPTIONS /query
Positive when: status_code == 200 and contains(tolower(header), "access-control-allow-origin: {{cors_origin}}") and contains(tolower(header), "access-control-allow-credentials: true")

Run it with nuclei: nuclei -id CVE-2026-61736 -u <target>

The full check

id: CVE-2026-61736

info:
  name: LightRAG <= 1.5.3 - Credentialed CORS Wildcard
  author: str4k3r
  severity: high
  description: |
    LightRAG <= 1.5.4 contains a broken access control vulnerability caused by default CORS_ORIGINS=* with allow_credentials=True in lightrag_server.py, letting malicious websites perform authenticated API requests, exploit requires authenticated user.
  impact: |
    Malicious websites can perform authenticated API requests to exfiltrate or delete data, leading to data loss and information disclosure.
  remediation: |
    Update to version 1.5.4 or later.
  reference:
    - https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w
    - https://github.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3d
    - https://nvd.nist.gov/vuln/detail/CVE-2026-61736
  classification:
    cve-id: CVE-2026-61736
    epss-score: 0.01422
    epss-percentile: 0.73098
    cwe-id: CWE-942
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
    cvss-score: 9.3
  metadata:
    verified: true
    max-request: 2
    vendor: hkuds
    product: lightrag
    shodan-query: http.html:"LightRAG"
    fofa-query: body="LightRAG"
  tags: cve,cve2026,lightrag,cors,misconfig

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    max-redirects: 3

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(tolower(body), "lightrag", "light-rag", "knowledge graph")'
        condition: and
        internal: true

  - raw:
      - |
        OPTIONS /query HTTP/1.1
        Host: {{Hostname}}
        Origin: {{cors_origin}}
        Access-Control-Request-Method: POST
        Access-Control-Request-Headers: authorization,content-type

    payloads:
      cors_origin:
        - "https://{{tolower(rand_base(5))}}.com"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(tolower(header), "access-control-allow-origin: {{cors_origin}}")'
          - 'contains(tolower(header), "access-control-allow-credentials: true")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from