CVE-2026-85740: LightRAG SSRF via IPv6-transition address bypass in markdown image download

CVE-2026-85740 · Severity: high · CVSS 7.1 · Published 2026-09-22

LightRAG's native markdown parser automatically downloads images referenced in uploaded documents. A security check is meant to prevent requests to internal or private IP addresses, but an attacker can bypass it by encoding an internal IP address using IPv6 transition formats (NAT64, IPv4-compatible, 6to4). On a network with NAT64/DNS64 routing, this allows an attacker with document upload capability to read internal metadata endpoints, cloud credentials, or other RFC1918-only services.

Technologies: HKUDS LightRAG, lightrag-hku (PyPI). Vendors: HKUDS, PyPI.

Quick answers

Is CVE-2026-85740 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-85740 being exploited in the wild.
How severe is CVE-2026-85740?
High severity, with a CVSS score of 7.1, published 22 September 2026.
Which products and versions are affected?
HKUDS LightRAG <= 1.5.4; lightrag-hku (PyPI) < 1.5.5, ECOSYSTEM:introduced=0,fixed=1.5.5.
Is there a fix for CVE-2026-85740?
Yes. lightrag-hku (PyPI): upgrade to 1.5.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85740 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-85740?
Check whether you run HKUDS LightRAG or lightrag-hku (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • lightrag-hku (PyPI): upgrade to 1.5.5 or later
    pip install "lightrag-hku>=1.5.5"

Technical details

The vulnerability exists in the `_validated_addresses()` guard function in `lightrag/parser/markdown/parser.py`. It checks whether a resolved IP address is globally routable using Python's `ipaddress.is_global` property, but IPv6 transition wrappers (NAT64 with prefixes `64:ff9b::/96` and `64:ff9b:1::/48`, IPv4-compatible `::/96`, and 6to4 `2002::/16`) are classified as globally routable despite embedding internal IPv4 addresses. The guard fails to decode and validate the embedded IPv4, allowing requests like `[64:ff9b::7f00:1]` (embedding loopback) to bypass the check. Attack requires document upload capability (API key authentication) and NAT64/DNS64 network routing on the target host. An attacker can then fetch internal-only endpoints (cloud metadata, RFC1918 hosts, loopback services) and ingest the response body. Patched in PR #3426 by decoding embedded IPv4 addresses and validating them independently, with default-deny for ambiguous transition formats (RFC 8215 local-use and 6to4 prefixes).

Affected products

  • HKUDS LightRAG <= 1.5.4

Identifiers

  • CVE-2026-85740
  • GHSA-vv3m-f8x4-7377
  • PYSEC-2026-4064

Timeline

  • 2026-09-22: disclosed: Advisory published
  • 2026: patched: Addressed in PR #3426, targeted for release 1.5.5

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.