CVE-2026-61808CWE-306

CVE-2026-61808

Critical · published August 8, 2026

CVSS v3.1
9.8
EPSS
2%
Percentile
84.6
In the wild
Unconfirmed
What it is

LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modify the knowledge graph, cancel pipelines, clear caches, and consume LLM resources. This issue is mitigated in version 1.5.5rc1.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02497 · 84.6th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-08-08T00:16Z
References (3)
https://github.com/HKUDS/LightRAG/commit/0bd102401b4b28a02664e5b6af476bf7a4470292 · [email protected]https://github.com/HKUDS/LightRAG/security/advisories/GHSA-mmg5-8x8q-v934 · [email protected]https://github.com/HKUDS/LightRAG/security/advisories/GHSA-mmg5-8x8q-v934 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 07 AUG 20:09Z
    LightRAG: Missing Authentication for Critical API Functions in Default Configuration
    cvelistv5