SSRF via IPv6-Transition Address Bypass in LightRAG

LightRAG's native markdown image-download mechanism contains a flawed SSRF guard in lightrag/parser/markdown/parser.py. The _validated_addresses() function performs an is_global check on resolved IP addresses but fails to account for IPv6-transition wrappers (NAT64, IPv4-compatible, and 6to4) that encapsulate internal IPv4 addresses. On network segments utilizing NAT64/DNS64 routing, these transition addresses bypass the application-level validation because the Python ipaddress library classifies the wrapper itself as globally routable. An attacker with the ability to upload markdown or textpack documents can supply these specially crafted addresses to force the server to initiate HTTP requests against internal infrastructure, including loopback services, RFC1918 internal network segments, and cloud provider metadata endpoints (e.g., 169.254.169.254). This vulnerability (CVE-2026-85740) allows for the unauthorized retrieval of internal data, credentials, and configuration metadata from the hosting environment.

Attack Chain

1. Attacker obtains valid authentication for the LightRAG instance (e.g., via combined_auth).
2. Attacker crafts a malicious markdown document embedding an image URL containing an IPv6-wrapped internal IPv4 address (e.g., http://[64:ff9b::0a42:0002]/x.png for 10.66.0.2).
3. Attacker uploads the document to the LightRAG API or platform.
4. The application's native markdown engine triggers _download() to fetch the referenced external images.
5. The guard _validated_addresses() resolves the target host and performs an is_global check on the wrapper; the check returns true, allowing the connection.
6. The _build_guarded_opener initiates an outbound HTTP request to the NAT64 gateway.
7. The gateway translates the IPv6 address to the internal IPv4 target and delivers the request to the restricted service.
8. The application ingests the response body from the internal service, effectively exfiltrating the data to the attacker.

Impact

Successful exploitation allows for unauthorized SSRF against internal resources. This enables attackers to exfiltrate internal system data, harvest sensitive instance metadata (such as IAM temporary credentials in cloud environments), and probe internal network services that were intended to be unreachable from the application server. The vulnerability is especially critical in IPv6-only or NAT64-enabled infrastructure environments.

Recommendation

Prioritize upgrading to LightRAG 1.5.5 or later, which implements recursive decoding of transition wrappers and rejects internal destinations regardless of the IPv6 encoding used. In the interim, operators should explicitly set the NATIVE_MD_IMAGE_ALLOWED_NON_PUBLIC_CIDRS configuration to restrict permitted egress or disable the native markdown image download functionality (NATIVE_MD_IMAGE_DOWNLOAD_ENABLED=False) if it is not business-critical. Detection engineers should inspect web server and proxy logs for requests containing IPv6-literal addresses, particularly those within the 64:ff9b::/96 range, to identify potential exploitation attempts.