CVE-2026-61736

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-61736", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-10T18:59:00.047Z", "datePublished": "2026-07-15T14:12:45.960Z", "dateUpdated": "2026-07-15T14:59:40.255Z"}, "containers": {"cna": {"title": "LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests", "problemTypes": [{"descriptions": [{"cweId": "CWE-942", "lang": "en", "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w"}, {"name": "https://github.com/HKUDS/LightRAG/pull/3317", "tags": ["x_refsource_MISC"], "url": "https://github.com/HKUDS/LightRAG/pull/3317"}, {"name": "https://github.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3d", "tags": ["x_refsource_MISC"], "url": "https://github.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3d"}, {"name": "https://github.com/HKUDS/LightRAG/commit/df68d75f9dc29dd340ffb6794b48f48c4fdc9a2d", "tags": ["x_refsource_MISC"], "url": "https://github.com/HKUDS/LightRAG/commit/df68d75f9dc29dd340ffb6794b48f48c4fdc9a2d"}, {"name": "https://github.com/HKUDS/LightRAG/commit/ebba6548639c0f2e8919100eff76b401f1222252", "tags": ["x_refsource_MISC"], "url": "https://github.com/HKUDS/LightRAG/commit/ebba6548639c0f2e8919100eff76b401f1222252"}, {"name": "https://github.com/HKUDS/LightRAG/releases/tag/v1.5.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/HKUDS/LightRAG/releases/tag/v1.5.4"}], "affected": [{"vendor": "HKUDS", "product": "LightRAG", "versions": [{"version": "< 1.5.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-15T14:12:45.960Z"}, "descriptions": [{"lang": "en", "value": "LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating documents and knowledge graph data or performing destructive actions such as deleting the document store. This vulnerability is fixed in 1.5.4."}], "source": {"advisory": "GHSA-6x6h-qqr7-855w", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-15T14:59:36.894491Z", "id": "CVE-2026-61736", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T14:59:40.255Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-61736", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-15T14:59:36.894491Z"}}}], "references": [{"url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T14:59:30.317Z"}}], "cna": {"title": "LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests", "source": {"advisory": "GHSA-6x6h-qqr7-855w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "HKUDS", "product": "LightRAG", "versions": [{"status": "affected", "version": "< 1.5.4"}]}], "references": [{"url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w", "name": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/HKUDS/LightRAG/pull/3317", "name": "https://github.com/HKUDS/LightRAG/pull/3317", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3d", "name": "https://github.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/HKUDS/LightRAG/commit/df68d75f9dc29dd340ffb6794b48f48c4fdc9a2d", "name": "https://github.com/HKUDS/LightRAG/commit/df68d75f9dc29dd340ffb6794b48f48c4fdc9a2d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/HKUDS/LightRAG/commit/ebba6548639c0f2e8919100eff76b401f1222252", "name": "https://github.com/HKUDS/LightRAG/commit/ebba6548639c0f2e8919100eff76b401f1222252", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/HKUDS/LightRAG/releases/tag/v1.5.4", "name": "https://github.com/HKUDS/LightRAG/releases/tag/v1.5.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating documents and knowledge graph data or performing destructive actions such as deleting the document store. This vulnerability is fixed in 1.5.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-942", "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-15T14:12:45.960Z"}}}, "cveMetadata": {"cveId": "CVE-2026-61736", "state": "PUBLISHED", "dateUpdated": "2026-07-15T14:59:40.255Z", "dateReserved": "2026-07-10T18:59:00.047Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-15T14:12:45.960Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "LightRAG", "vendor": "HKUDS", "versions": [{"status": "affected", "version": "< 1.5.4"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating documents and knowledge graph data or performing destructive actions such as deleting the document store. This vulnerability is fixed in 1.5.4."}, {"lang": "es", "value": "LightRAG proporciona generaci\u00f3n aumentada por recuperaci\u00f3n simple y r\u00e1pida. Antes de 1.5.4, el servidor por defecto se configura con CORS_ORIGINS=* combinado con allow_credentials=True en lightrag/api/lightrag_server.py, lo que provoca que Starlette CORSMiddleware incluya en la lista blanca de forma efectiva cada origen para solicitudes de origen cruzado con credenciales. Cualquier sitio web malicioso visitado por un usuario autenticado de LightRAG puede realizar silenciosamente solicitudes de API autenticadas, exfiltrando documentos y datos del grafo de conocimiento o realizando acciones destructivas como eliminar el almac\u00e9n de documentos. Esta vulnerabilidad se corrige en 1.5.4."}], "id": "CVE-2026-61736", "lastModified": "2026-10-24T21:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-61736", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-15T14:59:36.894491Z", "version": "2.0.3"}}]}, "published": "2026-07-15T15:16:48.217", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3d"}, {"source": "security-advisories@github.com", "url": "https://github.com/HKUDS/LightRAG/commit/df68d75f9dc29dd340ffb6794b48f48c4fdc9a2d"}, {"source": "security-advisories@github.com", "url": "https://github.com/HKUDS/LightRAG/commit/ebba6548639c0f2e8919100eff76b401f1222252"}, {"source": "security-advisories@github.com", "url": "https://github.com/HKUDS/LightRAG/pull/3317"}, {"source": "security-advisories@github.com", "url": "https://github.com/HKUDS/LightRAG/releases/tag/v1.5.4"}, {"source": "security-advisories@github.com", "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-942"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.5.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "LightRAG", "source": "cna", "vendor": "HKUDS"}, "product": "lightrag", "vendor": "hkuds"}], "created": "2026-07-15T19:30:04.529487+00:00", "updated": "2026-07-31T03:45:04.678688+00:00", "vendors": ["hkuds", "hkuds$PRODUCT$lightrag"]}