HKUDS LightRAG
10 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-86062 | < 1.5.5 | LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-85740 | < 1.5.5 | LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard | HIGH 7.1 | 0.3 % | ||
| CVE-2026-85734 | < 1.5.5 | LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks | CRITICAL 9.1 | 0.6 % | ||
| CVE-2026-85725 | < 1.5.5 | LightRAG: Plaintext Passwords Compared Without Constant-Time Function | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-85709 | < 1.5.5 | LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-61808 | < 1.5.5rc1 | LightRAG: Missing Authentication for Critical API Functions in Default Configuration | CRITICAL 9.8 | 2.5 % | ||
| CVE-2026-61740 | < 1.5.4 | LightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection | CRITICAL 9.3 | 0.5 % | ||
| CVE-2026-61736 | < 1.5.4 | LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests | CRITICAL 9.3 | 1.4 % | ||
| CVE-2026-39413 | < 1.4.14 | LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG API | MEDIUM 6.5 | 0.2 % | ||
| CVE-2025-6773 | 1.3.0 ; 1.3.1 ; 1.3.2 ; … | HKUDS LightRAG File Upload document_routes.py upload_to_input_dir path traversal | MEDIUM 4.8 | 0.2 % |