CVE-2026-39413

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39413", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-07T00:23:30.595Z", "datePublished": "2026-04-08T19:41:23.909Z", "dateUpdated": "2026-04-22T15:28:31.845Z"}, "containers": {"cna": {"title": "LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG API", "problemTypes": [{"descriptions": [{"cweId": "CWE-347", "lang": "en", "description": "CWE-347: Improper Verification of Cryptographic Signature", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-8ffj-4hx4-9pgf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-8ffj-4hx4-9pgf"}], "affected": [{"vendor": "HKUDS", "product": "LightRAG", "versions": [{"version": "< 1.4.14", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-08T19:41:23.909Z"}, "descriptions": [{"lang": "en", "value": "LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.4.14, the LightRAG API is vulnerable to a JWT algorithm confusion attack where an attacker can forge tokens by specifying 'alg': 'none' in the JWT header. Since the jwt.decode() call does not explicitly deny the 'none' algorithm, a crafted token without a signature will be accepted as valid, leading to unauthorized access. This vulnerability is fixed in 1.4.14."}], "source": {"advisory": "GHSA-8ffj-4hx4-9pgf", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T20:18:28.117904Z", "id": "CVE-2026-39413", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T20:18:55.606Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-22T15:28:31.845Z"}, "references": [{"url": "https://github.com/github/advisory-database/issues/7373"}], "title": "CVE Program Container", "x_generator": {"engine": "ADPogram 0.0.1"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/github/advisory-database/issues/7373"}], "x_generator": {"engine": "ADPogram 0.0.1"}, "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-22T15:28:31.845Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39413", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-08T20:18:28.117904Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T20:18:48.737Z"}}], "cna": {"title": "LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG API", "source": {"advisory": "GHSA-8ffj-4hx4-9pgf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "HKUDS", "product": "LightRAG", "versions": [{"status": "affected", "version": "< 1.4.14"}]}], "references": [{"url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-8ffj-4hx4-9pgf", "name": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-8ffj-4hx4-9pgf", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.4.14, the LightRAG API is vulnerable to a JWT algorithm confusion attack where an attacker can forge tokens by specifying 'alg': 'none' in the JWT header. Since the jwt.decode() call does not explicitly deny the 'none' algorithm, a crafted token without a signature will be accepted as valid, leading to unauthorized access. This vulnerability is fixed in 1.4.14."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-08T19:41:23.909Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39413", "state": "PUBLISHED", "dateUpdated": "2026-04-22T15:28:31.845Z", "dateReserved": "2026-04-07T00:23:30.595Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-08T19:41:23.909Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "LightRAG", "vendor": "HKUDS", "versions": [{"status": "affected", "version": "< 1.4.14"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hkuds:lightrag:*:*:*:*:*:*:*:*", "matchCriteriaId": "80A2BB57-B14C-4542-8F7F-D0D6F20AFC31", "versionEndExcluding": "1.4.14", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.4.14, the LightRAG API is vulnerable to a JWT algorithm confusion attack where an attacker can forge tokens by specifying 'alg': 'none' in the JWT header. Since the jwt.decode() call does not explicitly deny the 'none' algorithm, a crafted token without a signature will be accepted as valid, leading to unauthorized access. This vulnerability is fixed in 1.4.14."}, {"lang": "es", "value": "LightRAG proporciona generaci\u00f3n aumentada por recuperaci\u00f3n simple y r\u00e1pida. Antes de la 1.4.14, la API de LightRAG es vulnerable a un ataque de confusi\u00f3n de algoritmo JWT donde un atacante puede falsificar tokens especificando 'alg': 'none' en la cabecera JWT. Dado que la llamada a jwt.decode() no deniega expl\u00edcitamente el algoritmo 'none', un token manipulado sin firma ser\u00e1 aceptado como v\u00e1lido, lo que lleva a un acceso no autorizado. Esta vulnerabilidad se corrigi\u00f3 en la 1.4.14."}], "id": "CVE-2026-39413", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.5, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39413", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-08T20:18:28.117904Z", "version": "2.0.3"}}]}, "published": "2026-04-08T20:16:25.877", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-8ffj-4hx4-9pgf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/github/advisory-database/issues/7373"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.14)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "LightRAG", "source": "cna", "vendor": "HKUDS"}, "product": "lightrag", "vendor": "hkuds"}], "analysis": {"en": {"generated_at": "2026-04-08T21:26:49.338617+00:00", "value": {"mitigation_remediation": ["Upgrade LightRAG to version 1.4.14 or later.", "Verify that JWT validation rejects tokens with the 'none' algorithm."], "summary": {"action": "Apply Patch", "impact": "Unauthorized Access"}, "threat_synthesis": {"affected_systems": "The affected product is LightRAG provided by the vendor HKUDS. Versions earlier than 1.4.14 are impacted. Any installation using a pre\u20111.4.14 release is susceptible to this flaw.", "description_and_impact": "The vulnerability arises from a JWT algorithm confusion flaw in the LightRAG API. A crafted JSON Web Token can specify an algorithm value of 'none', allowing the server to accept the token without verifying a signature. This bypasses authentication and permits an attacker to perform any action that the API would normally require valid credentials for. The primary consequence is unauthorized access to the application's functionality, potentially exposing sensitive data or allowing further exploitation.", "risk_and_exploitability": "With a CVSS score of 4.2 the vulnerability is considered moderate. No EPSS score is available and the vulnerability has not been listed in the CISA KEV catalog. The likely attack vector is remote, via the exposed API endpoint where an attacker can send a crafted JWT. Successful exploitation would result in bypassing authentication and gaining unauthorized access to the API."}}}}, "created": "2026-04-09T08:18:13.248518+00:00", "updated": "2026-04-09T08:27:35.639775+00:00", "vendors": ["hkuds", "hkuds$PRODUCT$lightrag"]}