LightRAG <= 1.5.4 - Missing Authentication

highseverity

7.5CVSS score

2.5%likelihood of exploitation, next 30 days

85%of all CVEs are less likely

Readycheck to confirm it

LightRAG through version 1.5.4 contains a broken access control vulnerability caused by the API server binding to all network interfaces with authentication disabled, letting unauthenticated network attackers fully control indexed documents and resources, exploit requires network access.

Impact

Unauthenticated attackers can read, modify, delete documents, and consume resources, leading to full system compromise and denial of service.

Fix

Update to version 1.5.5rc1 or later.

How to confirm it

Send: GET /health
Positive when: status_code == 200 and contains_any(tolower(body), "healthy", "lightrag", "status")
Send: GET /documents
Positive when: status_code == 200 and contains(content_type, "application/json") and contains_all(body, "statuses", "content_summary", "file_path")

Run it with nuclei: nuclei -id CVE-2026-61808 -u <target>

The full check

id: CVE-2026-61808

info:
  name: LightRAG <= 1.5.4 - Missing Authentication
  author: str4k3r
  severity: high
  description: |
    LightRAG through version 1.5.4 contains a broken access control vulnerability caused by the API server binding to all network interfaces with authentication disabled, letting unauthenticated network attackers fully control indexed documents and resources, exploit requires network access.
  impact: |
    Unauthenticated attackers can read, modify, delete documents, and consume resources, leading to full system compromise and denial of service.
  remediation: |
    Update to version 1.5.5rc1 or later.
  reference:
    - https://github.com/HKUDS/LightRAG/security/advisories/GHSA-mmg5-8x8q-v934
    - https://nvd.nist.gov/vuln/detail/CVE-2026-61808
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 2
    vendor: hkuds
    product: lightrag
    shodan-query: http.html:"LightRAG"
    fofa-query: body="LightRAG"
  tags: cve,cve2026,lightrag,lfi,traversal,ai

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /health HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(tolower(body), "healthy", "lightrag", "status")'
        condition: and
        internal: true

  - raw:
      - |
        GET /documents HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "statuses", "content_summary", "file_path")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from