PRODUCT PROFILE

LightRAG

Created from vulnerability 18555 relation agent

关联漏洞

共找到 2 条公开漏洞记录

高危CVE-2026-61736访问控制错误2026/09/30

LightRAG <= 1.5.3 - Credentialed CORS Wildcard

LightRAG <= 1.5.4 contains a broken access control vulnerability caused by default CORS_ORIGINS=* with allow_credentials=True in lightrag_server.py, letting malicious websites perform authenticated API requests, exploit requires authenticated user.

PoC 已收录LightRAG

CVSS9.3EPSS 1.4%

高危CVE-2026-61808文件包含2026/09/30

LightRAG <= 1.5.4 - Missing Authentication

LightRAG through version 1.5.4 contains a broken access control vulnerability caused by the API server binding to all network interfaces with authentication disabled, letting unauthenticated network attackers fully control indexed documents and resources, exploit requires network access.

PoC 已收录LightRAG

CVSS—EPSS 2.5%