Missing authentication for critical API functions in LightRAG API server (CVE-2026-61808)

The LightRAG API server binds to all network interfaces (0.0.0.0) with authentication disabled by default. In this default configuration, every administrative and data endpoint is reachable without credentials, as neither AUTH_ACCOUNTS nor LIGHTRAG_API_KEY is set and a wildcard CORS policy is applied. An unauthenticated network attacker can upload or delete documents, modify the knowledge graph, cancel running pipelines, clear LLM response caches, and consume LLM resources. Affected versions: - <= 1.5.4 We recommend updating to: 1.5.5. CVSS 9.8 · our assessment: act_now Reference: https://github.com/HKUDS/LightRAG/security/advisories/GHSA-mmg5-8x8q-v934 Details: https://vuln.today/cve/CVE-2026-61808