LightRAG <= 1.5.4 - Missing Authentication

id: CVE-2026-61808

info:
  name: LightRAG <= 1.5.4 - Missing Authentication
  author: str4k3r
  severity: high
  description: |
    LightRAG through version 1.5.4 contains a broken access control vulnerability caused by the API server binding to all network interfaces with authentication disabled, letting unauthenticated network attackers fully control indexed documents and resources, exploit requires network access.
  impact: |
    Unauthenticated attackers can read, modify, delete documents, and consume resources, leading to full system compromise and denial of service.
  remediation: |
    Update to version 1.5.5rc1 or later.
  reference:
    - https://github.com/HKUDS/LightRAG/security/advisories/GHSA-mmg5-8x8q-v934
    - https://nvd.nist.gov/vuln/detail/CVE-2026-61808
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 2
    vendor: hkuds
    product: lightrag
    shodan-query: http.html:"LightRAG"
    fofa-query: body="LightRAG"
  tags: cve,cve2026,lightrag,lfi,traversal,ai

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /health HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(tolower(body), "healthy", "lightrag", "status")'
        condition: and
        internal: true

  - raw:
      - |
        GET /documents HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "statuses", "content_summary", "file_path")'
        condition: and
# digest: 490a0046304402200af8e3fbcb6782ee7071df72d00a4e74b8df50cd58a10c682cf889f82341b01102203ccb4c95e97f30e01e4c118f3ad8a2cb503557ad0982714dc8541551bca8eb05:922c64590222798bb761d5b6d8e72950