CVE-2026-61736
CriticalLightRAG provides simple and fast retrieval-augmented generation.
Published Jul 15, 2026 · Updated Aug 12, 2026 · Also known as EUVD-2026-44670, GHSA-6x6h-qqr7-855w, PYSEC-2026-3474
Key Facts
Patch in the next maintenance window- CVE-2026-61736 is a critical-severity vulnerability (CVSS 9.3 v3.1) affecting lightrag-hku (pypi), LightRAG.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 1.4% probability of exploitation in the next 30 days.
- Fixed versions are available, including LightRAG 1.5.4, lightrag-hku 1.5.4.
- Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
CVSS v3.1
9.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
EPSS (30-day exploit likelihood)
1.4%
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2026-61736 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating documents and knowledge graph data or performing destructive actions such as deleting the document store. This vulnerability is fixed in 1.5.4.
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| lightrag-hkupypi | See advisory | 1.5.4 |
| LightRAG | >= < 1.5.4 | 1.5.4 |
Patched Releases
LightRAG
1.5.4
lightrag-hku
1.5.4
Timeline
Publicly disclosed
Jul 15, 2026
Last updated
Aug 12, 2026
Weakness Type
- CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61736.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-61736
- otherhttps://github.com/HKUDS/LightRAG
- otherhttps://github.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3d
FAQ
Common Questions.
LightRAG provides simple and fast retrieval-augmented generation.
Affected: lightrag-hku (pypi); LightRAG versions >= < 1.5.4. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including LightRAG 1.5.4, lightrag-hku 1.5.4.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Is CVE-2026-61736 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo