CVE-2026-61740

Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.5.4

Description An authentication bypass occurs when the software is deployed with LIGHTRAG API KEY configured but AUTH ACCOUNTS is not set. This happens because the lightrag/api/auth.py file reverts to a hardcoded DEFAULT TOKEN SECRET, allowing the /auth-status and /login endpoints to generate guest JSON Web Tokens (JWTs). Furthermore, the combined dependency function in lightrag/api/utils api.py accepts these guest tokens before verifying the API key. This allows a remote unauthenticated attacker to access endpoints protected by combined auth, enabling unauthorized document reading, uploading, deletion, graph mutation, and querying.

Recommendations Update LightRAG to version 1.5.4.