Is CVE-2026-61736 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61736 being exploited in the wild.

How severe is CVE-2026-61736?

Critical severity, with a CVSS score of 9.3, published 15 July 2026.

Which products and versions are affected?

HKUDS LightRAG < 1.5.4, <= 1.5.3; lightrag-hku (PyPI) <= 1.5.3, ECOSYSTEM:introduced=0,fixed=1.5.4.

Is there a fix for CVE-2026-61736?

Yes. lightrag-hku (PyPI): upgrade to 1.5.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61736 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-61736?

Check whether you run HKUDS LightRAG or lightrag-hku (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61736: HKUDS LightRAG permissive CORS policy in API server

Q: Which products and versions are affected?

HKUDS LightRAG < 1.5.4, <= 1.5.3; lightrag-hku (PyPI) <= 1.5.3, ECOSYSTEM:introduced=0,fixed=1.5.4.

Q: Is there a fix for CVE-2026-61736?

Yes. lightrag-hku (PyPI): upgrade to 1.5.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-61736 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-61736?

Check whether you run HKUDS LightRAG or lightrag-hku (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61736 · Severity: critical · CVSS 9.3 · Published 2026-07-15

LightRAG is an open-source knowledge graph and document management system. A security flaw in its web configuration allows malicious websites to perform actions on behalf of logged-in users. If an authenticated user visits a compromised site, attackers could silently steal private documents, access knowledge graph data, or delete stored information.

Technologies: HKUDS LightRAG, lightrag-hku (PyPI). Vendors: HKUDS, PyPI.

Quick answers

Is CVE-2026-61736 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61736 being exploited in the wild.
How severe is CVE-2026-61736?: Critical severity, with a CVSS score of 9.3, published 15 July 2026.
Which products and versions are affected?: HKUDS LightRAG < 1.5.4, <= 1.5.3; lightrag-hku (PyPI) <= 1.5.3, ECOSYSTEM:introduced=0,fixed=1.5.4.
Is there a fix for CVE-2026-61736?: Yes. lightrag-hku (PyPI): upgrade to 1.5.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61736 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-61736?: Check whether you run HKUDS LightRAG or lightrag-hku (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

lightrag-hku (PyPI): upgrade to 1.5.4 or later
```
pip install "lightrag-hku>=1.5.4"
```

Technical details

The LightRAG server defaults to a permissive Cross-Origin Resource Sharing (CORS) configuration where 'CORS_ORIGINS' is set to a wildcard ('*') while 'allow_credentials' is set to True. Due to the behavior of the underlying Starlette CORSMiddleware, when credentials are enabled with a wildcard origin, the middleware echoes the requesting origin back in the 'Access-Control-Allow-Origin' header. This effectively bypasses browser-level origin restrictions. A remote attacker can exploit this by enticing an authenticated user to visit a malicious webpage, which can then perform cross-origin authenticated API calls to the LightRAG server to exfiltrate data or delete document stores. The issue is fixed in version 1.5.4.

Affected products

HKUDS lightrag-hku <= 1.5.3

Identifiers

CVE-2026-61736
GHSA-6x6h-qqr7-855w
PYSEC-2026-3474

Timeline

2026-06-24: disclosed: Initial report to HKUDS/LightRAG
2026-07-15: advisory: NVD publication date
2026-07-20: patched: GitHub Advisory reviewed and published; version 1.5.4 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.