CVE-2026-61808

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-61808
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61808.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-61808
Aliases
  • GHSA-mmg5-8x8q-v934
Published
2026-08-07T20:09:49.052Z
Modified
2026-08-09T03:30:44.563327024Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
LightRAG: Missing Authentication for Critical API Functions in Default Configuration
Details

LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modify the knowledge graph, cancel pipelines, clear caches, and consume LLM resources. This issue is mitigated in version 1.5.5rc1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-306"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61808.json"
}
References

Affected packages

Git / github.com/hkuds/lightrag

Affected ranges

Type
GIT
Repo
https://github.com/hkuds/lightrag
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
55c5fee23b4f8a14e63acc2420dfbcca916d8e50
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.5.5rc1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

Other
temp
v1.*
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
v1.1.0
v1.1.1
v1.1.10
v1.1.11
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v1.2.1
v1.2.2
v1.2.3
v1.2.5
v1.2.6
v1.2.7
v1.2.8
v1.2.9
v1.3.0
v1.3.1
v1.3.10
v1.3.2
v1.3.3
v1.3.4
v1.3.6
v1.3.7
v1.3.8
v1.3.9
v1.4.0
v1.4.1
v1.4.10
v1.4.11
v1.4.11rc1
v1.4.11rc2
v1.4.12
v1.4.12rc1
v1.4.13
v1.4.13rc1
v1.4.14
v1.4.15
v1.4.16
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.4.7
v1.4.7rc2
v1.4.8
v1.4.8.1
v1.4.8.2
v1.4.8rc1
v1.4.8rc3
v1.4.8rc4
v1.4.8rc5
v1.4.8rc8
v1.4.8rc9
v1.4.9
v1.4.9.1
v1.4.9.10
v1.4.9.11
v1.4.9.2
v1.4.9.3
v1.4.9.4
v1.4.9.4rc1
v1.4.9.5
v1.4.9.6
v1.4.9.7
v1.4.9.8
v1.4.9.9
v1.4.9rc1
v1.4.9rc2
v1.4.9rc3
v1.4.9rc4
v1.5.0
v1.5.0rc2
v1.5.0rc3
v1.5.1
v1.5.2
v1.5.3
v1.5.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61808.json"