AIKIDO-2026-504584

TL;DR

LightRAG caches generated query answers under a key computed over the query text, mode, retrieval parameters, and LLM identity, but omits conversation_history from that key even though it is passed to the model and materially changes the answer. A caller who supplies conversation_history can therefore determine the answer stored for a given question, and that stored answer is later returned verbatim to callers who supply no history. Because the default whitelist exempts the Ollama-compatible /api/chat route, the writing caller can be unauthenticated while the reading caller is authenticated, and the poisoned answer is served alongside genuine references. The fix bypasses the query-answer cache for both read and write whenever conversation_history is non-empty.