Cloudanix VulnDB

CVE-2026-30762

High · 7.5

LightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass

CVSS

7.5

EPSS

—

Published

Apr 4, 2026

CISA due date

—

The record

Summary: The file lightrag/api/config.py (line 397) uses a default JWT secret "lightrag-jwt-default-secret" when the TOKEN_SECRET environment variable is not set. The AuthHandler in lightrag/api/auth.py (lines 24-25) uses this secret to sign and verify tokens. An unauthenticated attacker can forge valid JWT tokens using the publicly known default secret and gain access to any protected endpoint. Reproduction: 1. Install LightRAG v1.4.10 with AUTH_ACCOUNTS configured but no TOKEN_SECRET set 2. Use PyJWT to sign a token: jwt.encode({"sub": "admin", "role": "user"}, "lightrag-jwt-default-secret", algorithm="HS256") 3. Send a request to any protected endpoint with the header: Authorization: Bearer <forged_token> 4. Access is granted without valid credentials Suggested Fix: Require TOKEN_SECRET to be explicitly set when AUTH_ACCOUNTS is configured. Refuse to start the API server if authentication is enabled but no custom secret is provided. --- Venkata Avinash Taduturi taduturivenkata@gmail.com

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities