AIKIDO-2026-791695
lightrag-hku is vulnerable to Missing Authentication for Critical Function
73
High Risk
This Affects:
lightrag-hkuTL;DR
The lightrag-server API ships with authentication disabled by default while binding to 0.0.0.0 with a wildcard CORS policy. In this default configuration every administrative and data endpoint — document upload and deletion, knowledge-graph mutation, cache clearing, pipeline cancellation, and LLM queries — is reachable without any credentials. Operators who follow the quickstart without setting AUTH_ACCOUNTS or LIGHTRAG_API_KEY expose a fully open server to any network client, and the default WHITELIST_PATHS also leaves the Ollama-compatible /api/* routes open. The fix adds prominent startup security banners, setup-wizard prompts, and documentation so the exposure is loud and visible while preserving the open-by-default local mode.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run the server exposed to an untrusted network without configuring AUTH_ACCOUNTS or LIGHTRAG_API_KEY.
Background info
lightrag-hku is vulnerable to Missing Authentication for Critical Function in versions 0.0.1 - 1.5.4.
How to fix this
Upgrade the lightrag-hku library to the patch version for clearer startup security warnings, then set AUTH_ACCOUNTS or LIGHTRAG_API_KEY before exposing the server to an untrusted network. Upgrading alone does not enable authentication or close the default open mode.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant