What’s Vulnerable › Products

HKUDS LightRAG vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.

Check whether your HKUDS LightRAG version is affected

Latest HKUDS LightRAG vulnerabilities

• CVE-2026-86062 — LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content (CVSS 6.1)
• CVE-2026-85740 — LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard (CVSS 7.1)
• CVE-2026-85734 — LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks (CVSS 9.1)
• CVE-2026-85725 — LightRAG: Plaintext Passwords Compared Without Constant-Time Function (CVSS 5.9)
• CVE-2026-85709 — LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses (CVSS 5.3)
• CVE-2026-61808 — LightRAG: Missing Authentication for Critical API Functions in Default Configuration (CVSS 9.8)
• CVE-2026-61740 — LightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection (CVSS 9.3)
• CVE-2026-61736 — LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests (CVSS 9.3)
• CVE-2026-39413 — LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG API (CVSS 6.5)
• CVE-2025-6773 — HKUDS LightRAG File Upload document_routes.py upload_to_input_dir path traversal (CVSS 5.3)