Executive brief
LightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass
Affected products
- PyPI lightrag-hku
Junglewise Threat Intelligence
CVE-2026-30762: PYSEC-2026-2593 - LightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass
CVE-2026-30762 · Severity: low · CVSS 3.1 · Published 2026-07-13
Technologies: lightrag-hku (PyPI). Vendors: PyPI.
Related threats
- LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightrag_webui/src/components/retrieval/ChatMessage.tsx re
- LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, _validated_addresses in lightrag/parser/markdown/parser.py
- LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightrag_server.p
- LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in lightrag/api/passwords.py compares plai
- LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text