AIKIDO-2026-791695

lightrag-hku is vulnerable to Missing Authentication for Critical Function

Missing Authentication for Critical FunctionCVE-2026-61808 Published Aug 4, 2026

High Risk

This Affects:

lightrag-hku

0.0.1 - 1.5.4

Fixed in 1.5.5

Are you affected? Scan for Free

TL;DR

The lightrag-server API ships with authentication disabled by default while binding to 0.0.0.0 with a wildcard CORS policy. In this default configuration every administrative and data endpoint — document upload and deletion, knowledge-graph mutation, cache clearing, pipeline cancellation, and LLM queries — is reachable without any credentials. Operators who follow the quickstart without setting AUTH_ACCOUNTS or LIGHTRAG_API_KEY expose a fully open server to any network client, and the default WHITELIST_PATHS also leaves the Ollama-compatible /api/* routes open. The fix adds prominent startup security banners, setup-wizard prompts, and documentation so the exposure is loud and visible while preserving the open-by-default local mode.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you run the server exposed to an untrusted network without configuring AUTH_ACCOUNTS or LIGHTRAG_API_KEY.

Background info

lightrag-hku is vulnerable to Missing Authentication for Critical Function in versions 0.0.1 - 1.5.4.

How to fix this

Upgrade the lightrag-hku library to the patch version for clearer startup security warnings, then set AUTH_ACCOUNTS or LIGHTRAG_API_KEY before exposing the server to an untrusted network. Upgrading alone does not enable authentication or close the default open mode.