Which versions of LightRAG are affected by CVE-2026-61740?

HKUDS LightRAG before version 1.5.4 contains a critical authentication bypass vulnerability (CVSS 9.3) that allows unauthenticated remote attackers to completely circumvent API-key security controls…. A patch is available.

Is there a public PoC exploit available for CVE-2026-61740?

Yes, a public proof-of-concept exploit is available for CVE-2026-61740. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-61740?

Within 24 hours, identify all LightRAG deployments running versions before 1.5.4 with API-key-only mode enabled (LIGHTRAG_API_KEY set, AUTH_ACCOUNTS unset) and immediately restrict network access to trusted systems only if patching cannot be completed. Within 7 days, upgrade all affected LightRAG instances to version 1.5.4 or later and rotate all API keys. Within 30 days, audit access logs on affected systems for the vulnerability window to identify unauthorized document reads, uploads, deletes, or graph modifications.

LightRAG CVE-2026-61740

Q: What is the CVSS score of CVE-2026-61740?

CVE-2026-61740 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-44671 CRITICAL

Improper Authentication (CWE-287)

2026-07-15 GitHub_M

GHSA-f4vv-55c2-5789

Authentication Bypass Lightrag

9.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.4 CRITICAL

Unauthenticated network attacker (PR:N/UI:N/AC:L) in the affected profile reads data (C:H) and can upload/delete/mutate (I:H); deletion yields partial availability loss (A:L), scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 17:48 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 15:18 vuln.today

Analysis Generated

Jul 15, 2026 - 15:18 vuln.today

CVE Published

Jul 15, 2026 - 14:14 cve.org

CRITICAL 9.3

DescriptionCVE.org

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, when LightRAG is deployed with LIGHTRAG_API_KEY set but AUTH_ACCOUNTS unset, X-API-Key protection can be bypassed because lightrag/api/auth.py falls back to a hardcoded DEFAULT_TOKEN_SECRET, /auth-status and /login can mint guest JWTs, and combined_dependency in lightrag/api/utils_api.py accepts a valid guest token before checking the API key. A remote unauthenticated attacker can call endpoints guarded by combined_auth, including document read, upload, deletion, graph mutation, and query endpoints. This vulnerability is fixed in 1.5.4.

AnalysisAI

Authentication bypass in HKUDS LightRAG before 1.5.4 lets a remote unauthenticated attacker defeat X-API-Key protection when the server runs in the API-key-only profile (LIGHTRAG_API_KEY set, AUTH_ACCOUNTS unset). Because auth.py falls back to a public hardcoded DEFAULT_TOKEN_SECRET and /auth-status and /login freely mint guest JWTs, combined_dependency honored a guest token before ever checking the API key, exposing document read/upload/delete, graph mutation, and query endpoints. No public exploit is identified at time of analysis, but the underlying fix (PR #3319) ships a regression test showing that forging a valid guest token with the default secret is trivial; fixed in 1.5.4.

Technical ContextAI

LightRAG is an open-source retrieval-augmented generation (RAG) framework (cpe:2.3:a:hkuds:lightrag) whose FastAPI server layer enforces access via a combined_auth dependency implemented in lightrag/api/utils_api.py, backed by JWT handling in lightrag/api/auth.py. The root cause is CWE-287 (Improper Authentication): in the API-key-only deployment profile, auth_configured is False, so AuthHandler falls back to the compiled-in public DEFAULT_TOKEN_SECRET, meaning any party can locally sign a valid HS256 guest JWT (or simply request one from the unauthenticated /auth-status and /login endpoints). The flawed control flow in combined_dependency accepted any valid guest token and short-circuited (returned success) before reaching the mandatory X-API-Key check, so possession of the operator API key became optional. The fix reorders the logic so that in API-key-only mode guest tokens are ignored and the X-API-Key header is the sole authority, while preserving guest access only in the fully-open mode (no API key and no AUTH_ACCOUNTS).

RemediationAI

Vendor-released patch: upgrade to LightRAG 1.5.4 or later, which reorders combined_dependency so guest tokens are ignored in the API-key-only profile and the X-API-Key header becomes mandatory (see GHSA-f4vv-55c2-5789, PR #3319, commit f7819aa, release tag v1.5.4). If you cannot patch immediately, the most direct compensating control is to eliminate the vulnerable configuration: either configure real password authentication by setting AUTH_ACCOUNTS (which makes auth_configured True and stops the guest-token fallback), or, if the deployment is meant to be private, place it fully behind a network boundary rather than relying on the API key alone. Additionally, override the JWT signing secret via TOKEN_SECRET so the server no longer falls back to the public DEFAULT_TOKEN_SECRET, and put the API behind a reverse proxy/WAF that requires the X-API-Key header and blocks unauthenticated access to /auth-status, /login, /documents, and query/graph endpoints. Trade-offs: setting AUTH_ACCOUNTS forces credentialed logins for the WebUI and API clients; network-level restriction breaks any intended public access; rotating TOKEN_SECRET invalidates existing tokens and forces re-login.