Executive brief
LightRAG's native markdown parser automatically downloads images referenced in uploaded documents. A security check is meant to prevent requests to internal or private IP addresses, but an attacker can bypass it by encoding an internal IP address using IPv6 transition formats (NAT64, IPv4-compatible, 6to4). On a network with NAT64/DNS64 routing, this allows an attacker with document upload capability to read internal metadata endpoints, cloud credentials, or other RFC1918-only services.
Technical details
The vulnerability exists in the `_validated_addresses()` guard function in `lightrag/parser/markdown/parser.py`. It checks whether a resolved IP address is globally routable using Python's `ipaddress.is_global` property, but IPv6 transition wrappers (NAT64 with prefixes `64:ff9b::/96` and `64:ff9b:1::/48`, IPv4-compatible `::/96`, and 6to4 `2002::/16`) are classified as globally routable despite embedding internal IPv4 addresses. The guard fails to decode and validate the embedded IPv4, allowing requests like `[64:ff9b::7f00:1]` (embedding loopback) to bypass the check. Attack requires document upload capability (API key authentication) and NAT64/DNS64 network routing on the target host. An attacker can then fetch internal-only endpoints (cloud metadata, RFC1918 hosts, loopback services) and ingest the response body. Patched in PR #3426 by decoding embedded IPv4 addresses and validating them independently, with default-deny for ambiguous transition formats (RFC 8215 local-use and 6to4 prefixes).
Affected products
- HKUDS LightRAG <= 1.5.4
Timeline
- 2026-09-22: disclosed: Advisory published
- 2026: patched: Addressed in PR #3426, targeted for release 1.5.5