CVE-2026-61736

{
  "id": "CVE-2026-61736",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-15T15:16:48.217",
  "lastModified": "2026-10-24T21:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating documents and knowledge graph data or performing destructive actions such as deleting the document store. This vulnerability is fixed in 1.5.4."
    },
    {
      "lang": "es",
      "value": "LightRAG proporciona generación aumentada por recuperación simple y rápida. Antes de 1.5.4, el servidor por defecto se configura con CORS_ORIGINS=* combinado con allow_credentials=True en lightrag/api/lightrag_server.py, lo que provoca que Starlette CORSMiddleware incluya en la lista blanca de forma efectiva cada origen para solicitudes de origen cruzado con credenciales. Cualquier sitio web malicioso visitado por un usuario autenticado de LightRAG puede realizar silenciosamente solicitudes de API autenticadas, exfiltrando documentos y datos del grafo de conocimiento o realizando acciones destructivas como eliminar el almacén de documentos. Esta vulnerabilidad se corrige en 1.5.4."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "HKUDS",
          "product": "LightRAG",
          "versions": [
            {
              "version": "< 1.5.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.8
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-15T14:59:36.894491Z",
          "id": "CVE-2026-61736",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-942"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3d",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/HKUDS/LightRAG/commit/df68d75f9dc29dd340ffb6794b48f48c4fdc9a2d",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/HKUDS/LightRAG/commit/ebba6548639c0f2e8919100eff76b401f1222252",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/HKUDS/LightRAG/pull/3317",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/HKUDS/LightRAG/releases/tag/v1.5.4",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}