CVE-2026-61736: LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
The server defaults to CORS_ORIGINS=* combined with allow_credentials=True. Starlette’s CORSMiddleware echoes the requesting origin in preflight responses when credentials are enabled, meaning every origin is effectively whitelisted for credentialed cross-origin requests. Any malicious website can perform authenticated API calls on behalf of a logged-in user.
References
- github.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3d
- github.com/HKUDS/LightRAG/commit/df68d75f9dc29dd340ffb6794b48f48c4fdc9a2d
- github.com/HKUDS/LightRAG/commit/ebba6548639c0f2e8919100eff76b401f1222252
- github.com/HKUDS/LightRAG/pull/3317
- github.com/HKUDS/LightRAG/releases/tag/v1.5.4
- github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w
- github.com/advisories/GHSA-6x6h-qqr7-855w
- nvd.nist.gov/vuln/detail/CVE-2026-61736
Code Behaviors & Features
Detect and mitigate CVE-2026-61736 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →