AIKIDO-2026-791695

lightrag-hku is vulnerable to Missing Authentication for Critical Function

CVE-2026-61808Published Aug 4, 2026

CVE Score

High

Missing Authentication for Critical Function

TL;DR

The lightrag-server API ships with authentication disabled by default while binding to 0.0.0.0 with a wildcard CORS policy. In this default configuration every administrative and data endpoint — document upload and deletion, knowledge-graph mutation, cache clearing, pipeline cancellation, and LLM queries — is reachable without any credentials. Operators who follow the quickstart without setting AUTH_ACCOUNTS or LIGHTRAG_API_KEY expose a fully open server to any network client, and the default WHITELIST_PATHS also leaves the Ollama-compatible /api/* routes open. The fix adds prominent startup security banners, setup-wizard prompts, and documentation so the exposure is loud and visible while preserving the open-by-default local mode.

How do I fix this?

Upgrade the lightrag-hku library to the patch version for clearer startup security warnings, then set AUTH_ACCOUNTS or LIGHTRAG_API_KEY before exposing the server to an untrusted network. Upgrading alone does not enable authentication or close the default open mode.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you run the server exposed to an untrusted network without configuring AUTH_ACCOUNTS or LIGHTRAG_API_KEY.