Description

LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modify the knowledge graph, cancel pipelines, clear caches, and consume LLM resources. This issue is mitigated in version 1.5.5rc1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-07T20:16:52.007Z",
  "pubdate": "2026-08-07T20:16:52.007Z",
  "executiveSummary": "LightRAG through version 1.5.4 suffers from an unauthenticated API access vulnerability due to the API server binding to all network interfaces with authentication disabled by default. This security deficiency exposes critical endpoints to the public network, permitting unauthenticated network attackers to interact with the retrieval-augmented generation infrastructure without any credential verification. The impact of successful exploitation is critical, as unauthorized actors can execute a wide array of administrative and data manipulation operations, including reading indexed document contents, uploading or deleting documents, modifying the underlying knowledge graph, canceling active pipelines, clearing system caches, and maliciously consuming heavy Large Language Model (LLM) resources. The affected product is LightRAG up to version 1.5.4. The risk implications include complete confidentiality loss of sensitive indexed documents, integrity compromise of the knowledge graph and document repository, and potential financial and operational denial of service through LLM resource exhaustion. Exploitation requirements are minimal, as the attacker only requires network connectivity to the exposed API server and no prior privileges or authentication tokens are necessary to execute arbitrary commands or data operations.",
  "technicalDetails": "The root cause of the vulnerability resides in the default configuration of the LightRAG API server. Through version 1.5.4, the application binds its listening sockets to all network interfaces (0.0.0.0 or equivalent) rather than restricting exposure to localhost or trusted internal networks. Compounding this broad network exposure, authentication mechanisms are entirely disabled by default for incoming API requests. The vulnerable component is the LightRAG API server module responsible for handling document management, pipeline execution, cache maintenance, and LLM interactions.\nThe attack flow proceeds as follows. First, an unauthenticated network attacker identifies an exposed LightRAG instance via network scanning targeting the default API ports. Second, because authentication checks are omitted or disabled by default, the attacker bypasses any identity verification phase entirely. Third, the attacker constructs HTTP requests targeting various administrative and operational endpoints exposed by the API server. These payloads enable the attacker to read sensitive indexed document content, upload arbitrary malicious documents, delete existing records, and directly modify the knowledge graph structure. Furthermore, the attacker can issue commands to cancel active data processing pipelines, clear system caches, and trigger intensive operations designed to consume extensive LLM computational resources, resulting in denial of service or financial drainage of API quotas.\nThe attack prerequisites require no user interaction, zero privileges, and no authentication tokens. The network exposure is broad due to the wildcard binding behavior. Post-exploitation impact encompasses unauthorized data exfiltration, data tampering, resource depletion, and operational disruption of the retrieval-augmented generation services."
}