LightRAG vulnerabilities
CVEs whose affected-version data names the LightRAG package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-85709Medium· 5.3PoCLightRAG provides simple and fast retrieval-augmented generation
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text from error handlers in document_routes.py, graph_routes.py, query_routes.py, ollama_api.py, and l…
CVE-2026-85725Medium· 5.9LightRAG provides simple and fast retrieval-augmented generation
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in lightrag/api/passwords.py compares plaintext AUTH_ACCOUNTS password values with Python's == operator. The comparison can return after th…
CVE-2026-85740High· 7.1LightRAG provides simple and fast retrieval-augmented generation
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, _validated_addresses in lightrag/parser/markdown/parser.py evaluates the literal resolved address with ipaddress.is_global without consistently classifying…
CVE-2026-85734Critical· 9.1LightRAG provides simple and fast retrieval-augmented generation
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightrag_server.py does not impose a rate limit, account lockout, delay, or counter for failed authentication atte…
CVE-2026-86062Medium· 6.1PoCLightRAG provides simple and fast retrieval-augmented generation
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightrag_webui/src/components/retrieval/ChatMessage.tsx renders answer and thinking content with react-markdown, rehypeRaw, and skipHtml=false without an H…