Logo
Retour à la veille

CVE-2026-61736

Publié : 15 juillet 2026
Modifié : 15 juillet 2026
Lien officiel NVD
Score CVSS
9.3
CRITICAL

Description détaillée

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating documents and knowledge graph data or performing destructive actions such as deleting the document store. This vulnerability is fixed in 1.5.4.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Références et Patchs

https://github.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3dhttps://github.com/HKUDS/LightRAG/commit/df68d75f9dc29dd340ffb6794b48f48c4fdc9a2dhttps://github.com/HKUDS/LightRAG/commit/ebba6548639c0f2e8919100eff76b401f1222252https://github.com/HKUDS/LightRAG/pull/3317https://github.com/HKUDS/LightRAG/releases/tag/v1.5.4https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855whttps://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w

Dernières Vulnérabilités

CVE-2026-62378

RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored cross-site scripting in the management console and exposure of administrator AccessKeyId, SecretAccessKey, and SessionToken values. This is caused by a regression of CVE-2026-27822. This vulnerability is fixed in 0.1.10.

VOIR DÉTAILS

CVE-2026-62287

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-61873. Reason: This candidate is a duplicate of CVE-2026-61873. Notes: All CVE users should reference CVE-2026-61873 instead of this candidate.

VOIR DÉTAILS

CVE-2026-62248

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-61438. Reason: This candidate is a duplicate of CVE-2026-61438. Notes: All CVE users should reference CVE-2026-61438 instead of this candidate.

VOIR DÉTAILS