https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 23 Sep 2026 16:32:36 +0000 https://vulnerability.circl.lu/sighting/cf375d0e-153d-418f-9d42-5565bdc4c9f2/export {"uuid": "cf375d0e-153d-418f-9d42-5565bdc4c9f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85740", "type": "seen", "source": "https://gist.github.com/alon710/7a56289e51a2a4574f7acda3d1a9a360", "content": "# CVE-2026-85740: CVE-2026-85740: Server-Side Request Forgery (SSRF) Guard Bypass via IPv6 Transition Wrappers in LightRAG\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-85740\n\n## Summary\nA security vulnerability in HKUDS/LightRAG prior to v1.5.5 allows authenticated attackers to bypass the native markdown image downloader guard. The system fails to normalize IPv6 transition wrappers (such as NAT64, IPv4-compatible, and 6to4 blocks) encapsulating internal IPv4 addresses. Python's ipaddress library evaluates these wrappers as globally routable, but hosting environments running NAT64/DNS64 routing decapsulate and route the requests to internal resources.\n\n## TL;DR\nLightRAG before v1.5.5 is vulnerable to SSRF because its image-download validator fails to inspect IPv4 addresses wrapped in IPv6 transition formats, permitting access to local networks and cloud metadata services.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: High (AC:H)\n- **Privileges Required**: Low (PR:L)\n- **Scope**: Changed (S:C)\n- **Impact**: Confidentiality: High, Integrity: Low, Availability: None\n- **Exploit Status**: PoC / Non-weaponized\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- HKUDS/LightRAG\n- **LightRAG**: < 1.5.5 (Fixed in: `1.5.5`)\n\n## Mitigation\n\n- Upgrade to LightRAG version 1.5.5 or higher.\n- Implement network egress restrictions for the RAG parsing environment.\n- Configure IMDSv2 with a strict hop-limit of 1 on host instances.\n\n**Remediation Steps:**\n1. Identify current LightRAG deployment version.\n2. Update dependency manifest to specify v1.5.5 or later.\n3. Rebuild and redeploy the container or application instance.\n4. Verify outward parser communication is filtered at the network layer.\n\n## References\n\n- [GitHub Security Advisory GHSA-vv3m-f8x4-7377](https://github.com/HKUDS/LightRAG/security/advisories/GHSA-vv3m-f8x4-7377)\n- [Fix Commit 9207e7fd](https://github.com/HKUDS/LightRAG/commit/9207e7fd10cf6df3cf26e3dd1921490b34a2f132)\n- [Fix Commit a2586217](https://github.com/HKUDS/LightRAG/commit/a25862177a9b00e0edb870778a42b4155924de09)\n- [Fix Commit c598545a](https://github.com/HKUDS/LightRAG/commit/c598545aa0084a427bcb19a84ade5e0ec31fa673)\n- [LightRAG Release v1.5.5](https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-85740) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T10:06:23.011783Z"} {"uuid": "cf375d0e-153d-418f-9d42-5565bdc4c9f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85740", "type": "seen", "source": "https://gist.github.com/alon710/7a56289e51a2a4574f7acda3d1a9a360", "content": "# CVE-2026-85740: CVE-2026-85740: Server-Side Request Forgery (SSRF) Guard Bypass via IPv6 Transition Wrappers in LightRAG\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-85740\n\n## Summary\nA security vulnerability in HKUDS/LightRAG prior to v1.5.5 allows authenticated attackers to bypass the native markdown image downloader guard. The system fails to normalize IPv6 transition wrappers (such as NAT64, IPv4-compatible, and 6to4 blocks) encapsulating internal IPv4 addresses. Python's ipaddress library evaluates these wrappers as globally routable, but hosting environments running NAT64/DNS64 routing decapsulate and route the requests to internal resources.\n\n## TL;DR\nLightRAG before v1.5.5 is vulnerable to SSRF because its image-download validator fails to inspect IPv4 addresses wrapped in IPv6 transition formats, permitting access to local networks and cloud metadata services.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: High (AC:H)\n- **Privileges Required**: Low (PR:L)\n- **Scope**: Changed (S:C)\n- **Impact**: Confidentiality: High, Integrity: Low, Availability: None\n- **Exploit Status**: PoC / Non-weaponized\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- HKUDS/LightRAG\n- **LightRAG**: < 1.5.5 (Fixed in: `1.5.5`)\n\n## Mitigation\n\n- Upgrade to LightRAG version 1.5.5 or higher.\n- Implement network egress restrictions for the RAG parsing environment.\n- Configure IMDSv2 with a strict hop-limit of 1 on host instances.\n\n**Remediation Steps:**\n1. Identify current LightRAG deployment version.\n2. Update dependency manifest to specify v1.5.5 or later.\n3. Rebuild and redeploy the container or application instance.\n4. Verify outward parser communication is filtered at the network layer.\n\n## References\n\n- [GitHub Security Advisory GHSA-vv3m-f8x4-7377](https://github.com/HKUDS/LightRAG/security/advisories/GHSA-vv3m-f8x4-7377)\n- [Fix Commit 9207e7fd](https://github.com/HKUDS/LightRAG/commit/9207e7fd10cf6df3cf26e3dd1921490b34a2f132)\n- [Fix Commit a2586217](https://github.com/HKUDS/LightRAG/commit/a25862177a9b00e0edb870778a42b4155924de09)\n- [Fix Commit c598545a](https://github.com/HKUDS/LightRAG/commit/c598545aa0084a427bcb19a84ade5e0ec31fa673)\n- [LightRAG Release v1.5.5](https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-85740) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T10:06:23.011783Z"} https://vulnerability.circl.lu/sighting/cf375d0e-153d-418f-9d42-5565bdc4c9f2/export Wed, 23 Sep 2026 10:06:23 +0000 https://vulnerability.circl.lu/sighting/01ca6093-eff9-46b0-b825-daa3ae663205/export {"uuid": "01ca6093-eff9-46b0-b825-daa3ae663205", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-85740", "type": "published-proof-of-concept", "source": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-vv3m-f8x4-7377", "content": "", "creation_timestamp": "2026-09-22T22:35:16.291965Z"} {"uuid": "01ca6093-eff9-46b0-b825-daa3ae663205", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-85740", "type": "published-proof-of-concept", "source": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-vv3m-f8x4-7377", "content": "", "creation_timestamp": "2026-09-22T22:35:16.291965Z"} https://vulnerability.circl.lu/sighting/01ca6093-eff9-46b0-b825-daa3ae663205/export Tue, 22 Sep 2026 22:35:16 +0000