Vulnerability-Lookup

CVE-2026-85709 (GCVE-0-2026-85709)

Vulnerability from cvelistv5 – Published: 2026-09-22 16:13 – Updated: 2026-09-22 18:12

Title

LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

Summary

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text from error handlers in document_routes.py, graph_routes.py, query_routes.py, ollama_api.py, and lightrag_server.py. The detail=str(e), detail=str(exc), and equivalent formatted-message paths expose server filesystem paths, database host, port, user, and database names, language-model provider diagnostics, configuration details, and Python library internals to a network client that can trigger an error. The default unauthenticated configuration makes those responses reachable without credentials, and URI-configured backends can disclose connection strings containing credentials depending on the underlying driver error. This issue is fixed in version 1.5.5.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 18:11 UTC

CWE

CWE-209 - Generation of Error Message Containing Sensitive Information

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/HKUDS/LightRAG/security/adviso…	x_refsource_CONFIRM
https://github.com/HKUDS/LightRAG/pull/3422	x_refsource_MISC
https://github.com/HKUDS/LightRAG/commit/4d90a0eb…	x_refsource_MISC
https://github.com/HKUDS/LightRAG/commit/dcab315d…	x_refsource_MISC
https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
HKUDS	LightRAG	Affected: < 1.5.5	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85709",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T18:11:51.350421Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T18:12:17.281Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-hrmj-7rvj-4hg8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "LightRAG",
          "vendor": "HKUDS",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.5.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text from error handlers in document_routes.py, graph_routes.py, query_routes.py, ollama_api.py, and lightrag_server.py. The detail=str(e), detail=str(exc), and equivalent formatted-message paths expose server filesystem paths, database host, port, user, and database names, language-model provider diagnostics, configuration details, and Python library internals to a network client that can trigger an error. The default unauthenticated configuration makes those responses reachable without credentials, and URI-configured backends can disclose connection strings containing credentials depending on the underlying driver error. This issue is fixed in version 1.5.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209: Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T16:13:53.046Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-hrmj-7rvj-4hg8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-hrmj-7rvj-4hg8"
        },
        {
          "name": "https://github.com/HKUDS/LightRAG/pull/3422",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/HKUDS/LightRAG/pull/3422"
        },
        {
          "name": "https://github.com/HKUDS/LightRAG/commit/4d90a0eb35d40b45f3a9045e308ec126897a3364",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/HKUDS/LightRAG/commit/4d90a0eb35d40b45f3a9045e308ec126897a3364"
        },
        {
          "name": "https://github.com/HKUDS/LightRAG/commit/dcab315d7dc1eea682e9b2c4fcb1b06474484c47",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/HKUDS/LightRAG/commit/dcab315d7dc1eea682e9b2c4fcb1b06474484c47"
        },
        {
          "name": "https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5"
        }
      ],
      "source": {
        "advisory": "GHSA-hrmj-7rvj-4hg8",
        "discovery": "UNKNOWN"
      },
      "title": "LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-85709",
    "datePublished": "2026-09-22T16:13:53.046Z",
    "dateReserved": "2026-09-04T14:45:10.647Z",
    "dateUpdated": "2026-09-22T18:12:17.281Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-85709",
      "date": "2026-09-23",
      "epss": "0.00419",
      "percentile": "0.35899"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "LightRAG",
                "vendor": "HKUDS",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.5.5"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text from error handlers in document_routes.py, graph_routes.py, query_routes.py, ollama_api.py, and lightrag_server.py. The detail=str(e), detail=str(exc), and equivalent formatted-message paths expose server filesystem paths, database host, port, user, and database names, language-model provider diagnostics, configuration details, and Python library internals to a network client that can trigger an error. The default unauthenticated configuration makes those responses reachable without credentials, and URI-configured backends can disclose connection strings containing credentials depending on the underlying driver error. This issue is fixed in version 1.5.5."
          }
        ],
        "id": "CVE-2026-85709",
        "lastModified": "2026-09-22T19:16:54.750",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-85709",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T18:11:51.350421Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-22T17:17:27.020",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/HKUDS/LightRAG/commit/4d90a0eb35d40b45f3a9045e308ec126897a3364"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/HKUDS/LightRAG/commit/dcab315d7dc1eea682e9b2c4fcb1b06474484c47"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/HKUDS/LightRAG/pull/3422"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-hrmj-7rvj-4hg8"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-hrmj-7rvj-4hg8"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-209"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-85709",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-22T18:11:51.350421Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-22T18:12:08.987Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-hrmj-7rvj-4hg8"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "LightRAG",
              "vendor": "HKUDS",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.5.5"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text from error handlers in document_routes.py, graph_routes.py, query_routes.py, ollama_api.py, and lightrag_server.py. The detail=str(e), detail=str(exc), and equivalent formatted-message paths expose server filesystem paths, database host, port, user, and database names, language-model provider diagnostics, configuration details, and Python library internals to a network client that can trigger an error. The default unauthenticated configuration makes those responses reachable without credentials, and URI-configured backends can disclose connection strings containing credentials depending on the underlying driver error. This issue is fixed in version 1.5.5."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-209",
                  "description": "CWE-209: Generation of Error Message Containing Sensitive Information",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-22T16:13:53.046Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-hrmj-7rvj-4hg8",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-hrmj-7rvj-4hg8"
            },
            {
              "name": "https://github.com/HKUDS/LightRAG/pull/3422",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/HKUDS/LightRAG/pull/3422"
            },
            {
              "name": "https://github.com/HKUDS/LightRAG/commit/4d90a0eb35d40b45f3a9045e308ec126897a3364",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/HKUDS/LightRAG/commit/4d90a0eb35d40b45f3a9045e308ec126897a3364"
            },
            {
              "name": "https://github.com/HKUDS/LightRAG/commit/dcab315d7dc1eea682e9b2c4fcb1b06474484c47",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/HKUDS/LightRAG/commit/dcab315d7dc1eea682e9b2c4fcb1b06474484c47"
            },
            {
              "name": "https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5"
            }
          ],
          "source": {
            "advisory": "GHSA-hrmj-7rvj-4hg8",
            "discovery": "UNKNOWN"
          },
          "title": "LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-85709",
        "datePublished": "2026-09-22T16:13:53.046Z",
        "dateReserved": "2026-09-04T14:45:10.647Z",
        "dateUpdated": "2026-09-22T18:12:17.281Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-85709

Vulnerability from fkie_nvd - Published: 2026-09-22 17:17 - Updated: 2026-09-22 19:16

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/HKUDS/LightRAG/commit/4d90a0eb35d40b45f3a9045e308ec126897a3364
	security-advisories@github.com	https://github.com/HKUDS/LightRAG/commit/dcab315d7dc1eea682e9b2c4fcb1b06474484c47
	security-advisories@github.com	https://github.com/HKUDS/LightRAG/pull/3422
	security-advisories@github.com	https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5
	security-advisories@github.com	https://github.com/HKUDS/LightRAG/security/advisories/GHSA-hrmj-7rvj-4hg8
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/HKUDS/LightRAG/security/advisories/GHSA-hrmj-7rvj-4hg8

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "LightRAG",
          "vendor": "HKUDS",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.5.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text from error handlers in document_routes.py, graph_routes.py, query_routes.py, ollama_api.py, and lightrag_server.py. The detail=str(e), detail=str(exc), and equivalent formatted-message paths expose server filesystem paths, database host, port, user, and database names, language-model provider diagnostics, configuration details, and Python library internals to a network client that can trigger an error. The default unauthenticated configuration makes those responses reachable without credentials, and URI-configured backends can disclose connection strings containing credentials depending on the underlying driver error. This issue is fixed in version 1.5.5."
    }
  ],
  "id": "CVE-2026-85709",
  "lastModified": "2026-09-22T19:16:54.750",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-85709",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-22T18:11:51.350421Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-22T17:17:27.020",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/HKUDS/LightRAG/commit/4d90a0eb35d40b45f3a9045e308ec126897a3364"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/HKUDS/LightRAG/commit/dcab315d7dc1eea682e9b2c4fcb1b06474484c47"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/HKUDS/LightRAG/pull/3422"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-hrmj-7rvj-4hg8"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-hrmj-7rvj-4hg8"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-209"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-HRMJ-7RVJ-4HG8

Vulnerability from github – Published: 2026-09-22 20:37 – Updated: 2026-09-22 20:37

Summary

lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

Details

Summary

The LightRAG API server passes raw Python exception messages directly into HTTP error responses across 30+ error handlers in every router. When combined with the default unauthenticated configuration (see companion report on CWE-306), any network-reachable client can trigger exceptions whose raw text discloses internal infrastructure — server filesystem paths, database host/port/user, LLM provider error details, and Python library internals. No global exception handler sanitizes error messages before they reach the client.

Details

Throughout the API route handlers, exceptions are caught and their string representation is returned verbatim via detail=str(e) / detail=str(exc) (and f-string variants such as detail=f"...: {str(e)}"). This occurs in every router file. Location breakdown on the current main branch:

HTTP 500 — raw exception passthrough (except Exception as e): - document_routes.py — 13 - graph_routes.py — 12 (mix of detail=f"...{str(e)}" and detail=error_msg) - query_routes.py — 3 - ollama_api.py — 2 - lightrag_server.py — 1 (health endpoint)

HTTP 422 — raw exception passthrough (except ValueError as exc): - document_routes.py — 2 (chunking-config validation)

Total: ~33 raw-exception-to-HTTP-response locations. The only pre-existing custom exception handler in lightrag_server.py is specific to RequestValidationError for /query/data; it does not cover the generic Exception handlers in route code.

Example pattern (document_routes.py, upload handler):

except Exception as e:
    logger.error(f"Error /documents/upload: {file.filename}: {str(e)}")
    raise HTTPException(status_code=500, detail=str(e))

Categories of sensitive information that can leak through these responses:

Server filesystem paths. File-I/O errors from the default JSON storage backend expose the server's directory layout (e.g. [Errno 13] Permission denied: '/app/data/rag_storage/default/kv_store_full_docs.json'), aiding path-traversal or targeted attacks. (Verified — see PoC Step 1.)
Database host / port / user / database name. Connection errors from the PostgreSQL, MongoDB, Redis, or Neo4j backends surface the target the driver was trying to reach — e.g. asyncpg raises password authentication failed for user "lightrag" (username) or a socket error naming the unreachable host and port. Note on credentials: the PostgreSQL backend uses asyncpg, which is built from keyword parameters and does not echo the password in its exception strings — so a raw asyncpg error leaks host/port/user/db, not the password. URI-configured backends behave differently: the MongoDB backend is built with AsyncMongoClient(MONGO_URI, ...), and a malformed-URI / configuration error from pymongo can surface the connection string itself, which may embed credentials (mongodb://user:password@host:port/). The leak surface is therefore backend- and error-type-dependent.
LLM provider error details. Errors from OpenAI / Gemini / Bedrock and other providers may include model names, organization ids, or partial API error context that reveal the deployment.
Python library internals. Unexpected exceptions expose class names, library-internal messages, and stack fragments that fingerprint the server stack and version.
Configuration details. Errors during configuration/parsing may reveal storage backend types and other configuration values.

The risk is amplified by the default unauthenticated configuration (CWE-306, companion report), which lets any network client trigger and read these errors without credentials.

PoC

Tested on a clean checkout with the [api] extras installed and the server run via lightrag-server.

Step 1 — Filesystem path disclosure (default JSON storage)

With the default storage backend, a file-permission error is returned verbatim:

# Make a storage file unreadable to force an I/O error.
chmod 000 ./rag_storage/default/kv_store_full_docs.json
curl -s http://localhost:9621/documents | python3 -m json.tool

Vulnerable response — the full server-side path is disclosed:

{
    "detail": "[Errno 13] Permission denied: '/app/data/rag_storage/default/kv_store_full_docs.json'"
}

Step 2 — Database infrastructure disclosure (PostgreSQL backend)

Configure a PostgreSQL KV backend pointed at an unreachable / misconfigured host:

LIGHTRAG_KV_STORAGE=PGKVStorage
POSTGRES_HOST=nonexistent-host-12345.example.com
POSTGRES_PORT=5432
POSTGRES_USER=lightrag
POSTGRES_DATABASE=lightrag

A request that touches storage returns the raw connection error, disclosing the host / port / user the server is configured to reach (the asyncpg password is not echoed — see the credentials note above):

{
    "detail": "[Errno -2] Name or service not known"
}

For a URI-configured backend such as MongoDB (MONGO_URI=mongodb://user:pass@host:port/db), a malformed-URI / configuration error can instead surface the connection string itself, including any embedded credentials.

Impact

Error-message information exposure. A client able to reach the LightRAG server can extract:

Confidentiality (C:L): server filesystem paths, database host/port/user/db, LLM provider configuration hints, and Python stack internals from raw exception messages; for URI-configured backends, potentially the connection string (with embedded credentials).
Escalation risk: leaked hosts/paths aid follow-on attacks; a leaked connection URI could enable direct database access if the database is network-reachable.

When combined with the default unauthenticated configuration, any network client can trigger and read these responses without authentication, which is why this is scored PR:N.

Suggested remediation

Replace every detail=str(e) / detail=str(exc) pattern with a generic client message. Log the full exception server-side (message + traceback) and return only a generic message plus a correlation id:

python except Exception as e: logger.error(f"Error /documents/upload: {file.filename}: {e!r}") raise HTTPException(status_code=500, detail="Internal server error")

Register a last-resort global handler as defense-in-depth so any exception that escapes a route is sanitized identically:

python @app.exception_handler(Exception) async def unhandled_exception_handler(request, exc): logger.error(f"Unhandled exception: {exc!r}", exc_info=True) return JSONResponse(status_code=500, content={"detail": "Internal server error"})

Preserve genuine client-input validation feedback. The two HTTP 422 chunking-config validators emit controlled, non-sensitive messages; keep them as 422 feedback rather than genericizing to 500 — but wrap the raw exception so it is never a bare passthrough.

Fix status: implemented in HKUDS/LightRAG#3422 — a shared internal_server_error() helper routes all 500 handlers through a generic body carrying a correlation id (full detail logged server-side), a global @app.exception_handler(Exception) is registered in create_app, and the two 422 validators are wrapped.

Credits

Thai Son Dinh from VinSOC Labs (R&D)
Nguyen Huy Vu Dung from VinSOC Labs (AppSec)

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.5.4"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "lightrag-hku"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-85709"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-22T20:37:36Z",
    "nvd_published_at": "2026-09-22T17:17:27Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe LightRAG API server passes raw Python exception messages directly into HTTP\nerror responses across 30+ error handlers in every router. When combined with\nthe default unauthenticated configuration (see companion report on CWE-306), any\nnetwork-reachable client can trigger exceptions whose raw text discloses\ninternal infrastructure \u2014 server filesystem paths, database host/port/user, LLM\nprovider error details, and Python library internals. No global exception\nhandler sanitizes error messages before they reach the client.\n\n### Details\n\nThroughout the API route handlers, exceptions are caught and their string\nrepresentation is returned verbatim via `detail=str(e)` / `detail=str(exc)`\n(and f-string variants such as `detail=f\"...: {str(e)}\"`). This occurs in every\nrouter file. Location breakdown on the current `main` branch:\n\n**HTTP 500 \u2014 raw exception passthrough (`except Exception as e`):**\n- `document_routes.py` \u2014 13\n- `graph_routes.py` \u2014 12 (mix of `detail=f\"...{str(e)}\"` and `detail=error_msg`)\n- `query_routes.py` \u2014 3\n- `ollama_api.py` \u2014 2\n- `lightrag_server.py` \u2014 1 (health endpoint)\n\n**HTTP 422 \u2014 raw exception passthrough (`except ValueError as exc`):**\n- `document_routes.py` \u2014 2 (chunking-config validation)\n\n**Total: ~33 raw-exception-to-HTTP-response locations.** The only pre-existing\ncustom exception handler in `lightrag_server.py` is specific to\n`RequestValidationError` for `/query/data`; it does not cover the generic\n`Exception` handlers in route code.\n\nExample pattern (`document_routes.py`, upload handler):\n\n```python\nexcept Exception as e:\n    logger.error(f\"Error /documents/upload: {file.filename}: {str(e)}\")\n    raise HTTPException(status_code=500, detail=str(e))\n```\n\n**Categories of sensitive information that can leak through these responses:**\n\n1. **Server filesystem paths.** File-I/O errors from the default JSON storage\n   backend expose the server\u0027s directory layout\n   (e.g. `[Errno 13] Permission denied: \u0027/app/data/rag_storage/default/kv_store_full_docs.json\u0027`),\n   aiding path-traversal or targeted attacks. *(Verified \u2014 see PoC Step 1.)*\n\n2. **Database host / port / user / database name.** Connection errors from the\n   PostgreSQL, MongoDB, Redis, or Neo4j backends surface the target the driver\n   was trying to reach \u2014 e.g. asyncpg raises\n   `password authentication failed for user \"lightrag\"` (username) or a socket\n   error naming the unreachable host and port.\n   **Note on credentials:** the PostgreSQL backend uses `asyncpg`, which is\n   built from keyword parameters and does **not** echo the password in its\n   exception strings \u2014 so a raw asyncpg error leaks host/port/user/db, not the\n   password. URI-configured backends behave differently: the MongoDB backend is\n   built with `AsyncMongoClient(MONGO_URI, ...)`, and a malformed-URI /\n   configuration error from pymongo can surface the connection string itself,\n   which may embed credentials (`mongodb://user:password@host:port/`). The leak\n   surface is therefore backend- and error-type-dependent.\n\n3. **LLM provider error details.** Errors from OpenAI / Gemini / Bedrock and\n   other providers may include model names, organization ids, or partial API\n   error context that reveal the deployment.\n\n4. **Python library internals.** Unexpected exceptions expose class names,\n   library-internal messages, and stack fragments that fingerprint the server\n   stack and version.\n\n5. **Configuration details.** Errors during configuration/parsing may reveal\n   storage backend types and other configuration values.\n\nThe risk is amplified by the default unauthenticated configuration (CWE-306,\ncompanion report), which lets any network client trigger and read these errors\nwithout credentials.\n\n### PoC\n\nTested on a clean checkout with the `[api]` extras installed and the server run\nvia `lightrag-server`.\n\n#### Step 1 \u2014 Filesystem path disclosure (default JSON storage)\n\nWith the default storage backend, a file-permission error is returned verbatim:\n\n```bash\n# Make a storage file unreadable to force an I/O error.\nchmod 000 ./rag_storage/default/kv_store_full_docs.json\ncurl -s http://localhost:9621/documents | python3 -m json.tool\n```\n\nVulnerable response \u2014 the full server-side path is disclosed:\n\n```json\n{\n    \"detail\": \"[Errno 13] Permission denied: \u0027/app/data/rag_storage/default/kv_store_full_docs.json\u0027\"\n}\n```\n\n#### Step 2 \u2014 Database infrastructure disclosure (PostgreSQL backend)\n\nConfigure a PostgreSQL KV backend pointed at an unreachable / misconfigured host:\n\n```\nLIGHTRAG_KV_STORAGE=PGKVStorage\nPOSTGRES_HOST=nonexistent-host-12345.example.com\nPOSTGRES_PORT=5432\nPOSTGRES_USER=lightrag\nPOSTGRES_DATABASE=lightrag\n```\n\nA request that touches storage returns the raw connection error, disclosing the\nhost / port / user the server is configured to reach (the asyncpg password is\nnot echoed \u2014 see the credentials note above):\n\n```json\n{\n    \"detail\": \"[Errno -2] Name or service not known\"\n}\n```\n\nFor a URI-configured backend such as MongoDB (`MONGO_URI=mongodb://user:pass@host:port/db`),\na malformed-URI / configuration error can instead surface the connection string\nitself, including any embedded credentials.\n\n### Impact\n\nError-message information exposure. A client able to reach the LightRAG\nserver can extract:\n\n- **Confidentiality (C:L):** server filesystem paths, database host/port/user/db,\n  LLM provider configuration hints, and Python stack internals from raw\n  exception messages; for URI-configured backends, potentially the connection\n  string (with embedded credentials).\n- **Escalation risk:** leaked hosts/paths aid follow-on attacks; a leaked\n  connection URI could enable direct database access if the database is\n  network-reachable.\n\nWhen combined with the default unauthenticated configuration, any\nnetwork client can trigger and read these responses without authentication,\nwhich is why this is scored `PR:N`.\n\n### Suggested remediation\n\n1. **Replace every `detail=str(e)` / `detail=str(exc)` pattern** with a generic\n   client message. Log the full exception server-side (message + traceback) and\n   return only a generic message plus a correlation id:\n\n   ```python\n   except Exception as e:\n       logger.error(f\"Error /documents/upload: {file.filename}: {e!r}\")\n       raise HTTPException(status_code=500, detail=\"Internal server error\")\n   ```\n\n2. **Register a last-resort global handler** as defense-in-depth so any\n   exception that escapes a route is sanitized identically:\n\n   ```python\n   @app.exception_handler(Exception)\n   async def unhandled_exception_handler(request, exc):\n       logger.error(f\"Unhandled exception: {exc!r}\", exc_info=True)\n       return JSONResponse(status_code=500, content={\"detail\": \"Internal server error\"})\n   ```\n\n3. **Preserve genuine client-input validation feedback.** The two HTTP 422\n   chunking-config validators emit controlled, non-sensitive messages; keep them\n   as 422 feedback rather than genericizing to 500 \u2014 but wrap the raw exception\n   so it is never a bare passthrough.\n\n**Fix status:** implemented in HKUDS/LightRAG#3422 \u2014 a shared\n`internal_server_error()` helper routes all 500 handlers through a generic body\ncarrying a correlation id (full detail logged server-side), a global\n`@app.exception_handler(Exception)` is registered in `create_app`, and the two\n422 validators are wrapped.\n\n### Credits\n- Thai Son Dinh from VinSOC Labs (R\u0026D)\n- Nguyen Huy Vu Dung from VinSOC Labs (AppSec)",
  "id": "GHSA-hrmj-7rvj-4hg8",
  "modified": "2026-09-22T20:37:36Z",
  "published": "2026-09-22T20:37:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-hrmj-7rvj-4hg8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85709"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/pull/3422"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/commit/4d90a0eb35d40b45f3a9045e308ec126897a3364"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/commit/dcab315d7dc1eea682e9b2c4fcb1b06474484c47"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/HKUDS/LightRAG"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-85709 (GCVE-0-2026-85709)

FKIE_CVE-2026-85709

GHSA-HRMJ-7RVJ-4HG8

Summary

Details

PoC

Step 1 — Filesystem path disclosure (default JSON storage)

Step 2 — Database infrastructure disclosure (PostgreSQL backend)

Impact

Suggested remediation

Credits

Tags

Sightings

Nomenclature

Related by attack behaviour