/Vulnerability Library

LightRAG <= 1.5.3 - Credentialed CORS Wildcard

CVE-2026-61736
Verified

Description

LightRAG <= 1.5.4 contains a broken access control vulnerability caused by default CORS_ORIGINS=* with allow_credentials=True in lightrag_server.py, letting malicious websites perform authenticated API requests, exploit requires authenticated user.

Severity

High

CVSS Score

9.3

Exploit Probability

1%

Affected Product

lightrag

Published Date

September 14, 2026

Template Author

str4k3r

CVE-2026-61736.yaml
9.3Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVE ID:
cve-2026-61736
CWE ID:
cwe-942

References

https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855whttps://github.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3dhttps://nvd.nist.gov/vuln/detail/CVE-2026-61736

Remediation Steps

Update to version 1.5.4 or later.