CVE-2026-85709: lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses
The LightRAG API server passes raw Python exception messages directly into HTTP error responses across 30+ error handlers in every router. When combined with the default unauthenticated configuration (see companion report on CWE-306), any network-reachable client can trigger exceptions whose raw text discloses internal infrastructure — server filesystem paths, database host/port/user, LLM provider error details, and Python library internals. No global exception handler sanitizes error messages before they reach the client.
References
- github.com/HKUDS/LightRAG/commit/4d90a0eb35d40b45f3a9045e308ec126897a3364
- github.com/HKUDS/LightRAG/commit/dcab315d7dc1eea682e9b2c4fcb1b06474484c47
- github.com/HKUDS/LightRAG/pull/3422
- github.com/HKUDS/LightRAG/releases/tag/v1.5.5
- github.com/HKUDS/LightRAG/security/advisories/GHSA-hrmj-7rvj-4hg8
- github.com/advisories/GHSA-hrmj-7rvj-4hg8
- nvd.nist.gov/vuln/detail/CVE-2026-85709
Code Behaviors & Features
Detect and mitigate CVE-2026-85709 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →