LightRAG <= 1.5.4 - Missing Authentication
CVE-2026-61808
Verified
Description
LightRAG through version 1.5.4 contains a broken access control vulnerability caused by the API server binding to all network interfaces with authentication disabled, letting unauthenticated network attackers fully control indexed documents and resources, exploit requires network access.
Severity
High
CVSS Score
7.5
Affected Product
lightrag
Published Date
August 8, 2026
Template Author
str4k3r
CVE-2026-61808.yaml
7.5Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE ID:
cwe-22
Remediation Steps
Update to version 1.5.5rc1 or later.