Product
The LightRAG application, specifically the 'lightrag-hku' package, contains a critical vulnerability (CVE-2026-61736) due to its default Cross-Origin Resource Sharing (CORS) configuration, enabling any malicious website to perform authenticated API calls on behalf of a logged-in LightRAG user, leading to unauthorized data exfiltration or destructive actions.