CVE-2026-61736 HKUDS CVE debrief

Who should care

Defenders and administrators of LightRAG systems should assess their exposure and prioritize upgrading to version 1.5.4 or applying appropriate configuration changes. They should also monitor for suspicious API requests and implement additional security measures to protect against cross-origin attacks. Operators, platform administrators, and security teams should review the vulnerability and take necessary actions to protect their systems.

Why it matters

CVE-2026-61736 is a critical vulnerability in LightRAG that allows credentialed cross-origin requests, potentially leading to data exfiltration or destructive actions. Defenders should prioritize upgrading to version 1.5.4 or applying appropriate configuration changes.

• Potential exfiltration of documents and knowledge graph data
• Destructive actions such as deleting the document store
• Elevation of privileges for malicious websites
• Bypass of security controls for cross-origin requests

Technical summary

The vulnerability is caused by the default configuration of CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py. This allows any malicious website visited by an authenticated LightRAG user to silently make authenticated API requests, potentially leading to the exfiltration of documents and knowledge graph data or destructive actions such as deleting the document store. The vulnerability affects LightRAG systems prior to version 1.5.4, and defenders should prioritize upgrading to this version or applying appropriate configuration changes to restrict CORS origins and credentials.

Defensive priority

Defenders should prioritize upgrading to version 1.5.4 or applying appropriate configuration changes to restrict CORS origins and credentials. They should also monitor for suspicious API requests and implement additional security measures to protect against cross-origin attacks.

Recommended defensive actions

• Upgrade LightRAG to version 1.5.4 or later
• Restrict CORS origins and credentials
• Monitor for suspicious API requests
• Implement additional security measures to protect against cross-origin attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is confirmed by the CVE Program and NVD records. Details are provided in the source references from GitHub, including commits and release notes. The affected product deployments should be reviewed for exposure, and defenders should verify the scope of the vulnerability and apply patches or mitigations accordingly. Additional security measures, such as monitoring for suspicious API requests and implementing compensating controls, should be considered to protect against cross-origin attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.