{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3ahkudslightrag/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:hkuds:lightrag:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-85740"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["LightRAG (\u003c= 1.5.4)"],"_cs_severities":["high"],"_cs_tags":["ssrf","vulnerability","cve"],"_cs_type":"advisory","_cs_vendors":["HKUDS"],"content_html":"\u003cp\u003eLightRAG's native markdown image-download mechanism contains a flawed SSRF guard in \u003ccode\u003elightrag/parser/markdown/parser.py\u003c/code\u003e. The \u003ccode\u003e_validated_addresses()\u003c/code\u003e function performs an \u003ccode\u003eis_global\u003c/code\u003e check on resolved IP addresses but fails to account for IPv6-transition wrappers (NAT64, IPv4-compatible, and 6to4) that encapsulate internal IPv4 addresses. On network segments utilizing NAT64/DNS64 routing, these transition addresses bypass the application-level validation because the Python \u003ccode\u003eipaddress\u003c/code\u003e library classifies the wrapper itself as globally routable. An attacker with the ability to upload markdown or textpack documents can supply these specially crafted addresses to force the server to initiate HTTP requests against internal infrastructure, including loopback services, RFC1918 internal network segments, and cloud provider metadata endpoints (e.g., 169.254.169.254). This vulnerability (CVE-2026-85740) allows for the unauthorized retrieval of internal data, credentials, and configuration metadata from the hosting environment.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker obtains valid authentication for the LightRAG instance (e.g., via \u003ccode\u003ecombined_auth\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious markdown document embedding an image URL containing an IPv6-wrapped internal IPv4 address (e.g., \u003ccode\u003ehttp://[64:ff9b::0a42:0002]/x.png\u003c/code\u003e for \u003ccode\u003e10.66.0.2\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker uploads the document to the LightRAG API or platform.\u003c/li\u003e\n\u003cli\u003eThe application's native markdown engine triggers \u003ccode\u003e_download()\u003c/code\u003e to fetch the referenced external images.\u003c/li\u003e\n\u003cli\u003eThe guard \u003ccode\u003e_validated_addresses()\u003c/code\u003e resolves the target host and performs an \u003ccode\u003eis_global\u003c/code\u003e check on the wrapper; the check returns true, allowing the connection.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003e_build_guarded_opener\u003c/code\u003e initiates an outbound HTTP request to the NAT64 gateway.\u003c/li\u003e\n\u003cli\u003eThe gateway translates the IPv6 address to the internal IPv4 target and delivers the request to the restricted service.\u003c/li\u003e\n\u003cli\u003eThe application ingests the response body from the internal service, effectively exfiltrating the data to the attacker.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized SSRF against internal resources. This enables attackers to exfiltrate internal system data, harvest sensitive instance metadata (such as IAM temporary credentials in cloud environments), and probe internal network services that were intended to be unreachable from the application server. The vulnerability is especially critical in IPv6-only or NAT64-enabled infrastructure environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize upgrading to LightRAG 1.5.5 or later, which implements recursive decoding of transition wrappers and rejects internal destinations regardless of the IPv6 encoding used. In the interim, operators should explicitly set the \u003ccode\u003eNATIVE_MD_IMAGE_ALLOWED_NON_PUBLIC_CIDRS\u003c/code\u003e configuration to restrict permitted egress or disable the native markdown image download functionality (\u003ccode\u003eNATIVE_MD_IMAGE_DOWNLOAD_ENABLED=False\u003c/code\u003e) if it is not business-critical. Detection engineers should inspect web server and proxy logs for requests containing IPv6-literal addresses, particularly those within the \u003ccode\u003e64:ff9b::/96\u003c/code\u003e range, to identify potential exploitation attempts.\u003c/p\u003e\n","date_modified":"2026-09-23T01:55:02Z","date_published":"2026-09-23T01:55:02Z","id":"https://feed.craftedsignal.io/briefs/2026-09-lightrag-ssrf/","summary":"LightRAG versions 1.5.4 and earlier are vulnerable to Server-Side Request Forgery (SSRF) because the markdown parser fails to sanitize IPv6-encoded internal IPv4 addresses, allowing access to internal services and cloud metadata.","title":"SSRF via IPv6-Transition Address Bypass in LightRAG","url":"https://feed.craftedsignal.io/briefs/2026-09-lightrag-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:hkuds:lightrag:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}