{"vulnerability": "cve-2026-85709", "sightings": [{"uuid": "df950a12-7b98-4209-a39b-8f97d367a1b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-85709", "type": "published-proof-of-concept", "source": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-hrmj-7rvj-4hg8", "content": "", "creation_timestamp": "2026-09-22T22:35:22.024446Z"}, {"uuid": "50126494-c1ba-4bf9-a54c-c8270db69204", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85709", "type": "seen", "source": "https://gist.github.com/alon710/74e359aa08359ada7f9cbef0f754a03e", "content": "# CVE-2026-85709: CVE-2026-85709: Sensitive Information Exposure in LightRAG API Server\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-85709\n\n## Summary\nCVE-2026-85709 is a sensitive information exposure vulnerability in HKUDS LightRAG prior to version 1.5.5. The vulnerability allows remote, unauthenticated clients to trigger server-side errors and receive raw Python exception details, including local filesystem paths, database connection strings, credentials, and internal system configurations.\n\n## TL;DR\nImproper error handling in LightRAG's FastAPI server prior to version 1.5.5 permits unauthenticated network clients to leak highly sensitive infrastructure details, including absolute filesystem paths and database host parameters, by triggering raw exception traces.\n\n## Technical Details\n\n- **CWE ID**: CWE-209\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.3 (Medium)\n- **Exploit Status**: No Public Exploits\n- **Impact**: Partial Confidentiality Leak\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- HKUDS LightRAG\n- **LightRAG**: < 1.5.5 (Fixed in: `1.5.5`)\n\n## Mitigation\n\n- Upgrade LightRAG to version 1.5.5 or higher.\n- Enforce API authentication using the LIGHTRAG_API_KEY environment variable.\n- Implement network-level access control lists to block public access to the API port (default 9621).\n\n**Remediation Steps:**\n1. Terminate the active LightRAG API server instance.\n2. Upgrade the local package dependency using 'pip install --upgrade lightrag>=1.5.5'.\n3. Configure the 'LIGHTRAG_API_KEY' environment variable to mandate authentication across all routes.\n4. Restart the API server and verify that failed endpoints output only sanitized correlation IDs.\n\n## References\n\n- [GitHub Security Advisory GHSA-hrmj-7rvj-4hg8](https://github.com/HKUDS/LightRAG/security/advisories/GHSA-hrmj-7rvj-4hg8)\n- [LightRAG Pull Request #3422](https://github.com/HKUDS/LightRAG/pull/3422)\n- [LightRAG Release v1.5.5](https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5)\n- [Fix Commit: Centralized Sanitization Helper](https://github.com/HKUDS/LightRAG/commit/dcab315d7dc1eea682e9b2c4fcb1b06474484c47)\n- [Fix Commit: Chunking 422 Sanitization](https://github.com/HKUDS/LightRAG/commit/4d90a0eb35d40b45f3a9045e308ec126897a3364)\n- [NVD CVE-2026-85709 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-85709)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-85709) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T11:32:02.878702Z"}]}