CVE-2026-61736

The record

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating documents and knowledge graph data or performing destructive actions such as deleting the document store. This vulnerability is fixed in 1.5.4.

Affected packages

Related vulnerabilities

• CVE-2026-62863 MoLing is a computer-use and browser-use based MCP server. CWE-942
• CVE-2026-119285 Fiber is an Express inspired web framework written in Go. CWE-942
• CVE-2026-110737 The push endpoint of a Vaadin application that uses server push reflects the request… CWE-942
• CVE-2026-116748 Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in… CWE-942
• CVE-2026-115917 vLLM is an inference and serving engine for large language models. CWE-942
• CVE-2026-107858 Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy… CWE-942
• CVE-2026-89058 A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins… CWE-942
• CVE-2026-53649 Joro is a web exploitation framework. CWE-942