{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/cors-misconfiguration/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.3,"id":"CVE-2026-61736"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["lightrag-hku (\u003c= 1.5.3)"],"_cs_severities":["critical"],"_cs_tags":["cors-misconfiguration","web-vulnerability","data-exfiltration","cve"],"_cs_type":"advisory","_cs_vendors":["LightRAG"],"content_html":"\u003cp\u003eA critical Cross-Origin Resource Sharing (CORS) misconfiguration, identified as CVE-2026-61736, affects the LightRAG application's \u003ccode\u003elightrag-hku\u003c/code\u003e package in versions prior to 1.5.4. The vulnerability stems from the default server configuration in \u003ccode\u003elightrag/api/config.py\u003c/code\u003e and \u003ccode\u003elightrag/api/lightrag_server.py\u003c/code\u003e, which sets \u003ccode\u003eCORS_ORIGINS\u003c/code\u003e to \u003ccode\u003e*\u003c/code\u003e (wildcard) while also enabling \u003ccode\u003eallow_credentials=True\u003c/code\u003e for Starlette's \u003ccode\u003eCORSMiddleware\u003c/code\u003e. This combination causes the server to echo the requesting origin in preflight responses, effectively whitelisting any origin for credentialed cross-origin requests. Attackers can leverage this flaw by hosting a malicious website that performs authenticated API calls to LightRAG on behalf of a victim user who is logged into LightRAG, allowing for data exfiltration of documents and knowledge graphs or the execution of destructive actions.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker hosts a malicious website (e.g., \u003ccode\u003eattacker.com\u003c/code\u003e) designed to interact with LightRAG.\u003c/li\u003e\n\u003cli\u003eA victim, who is logged into their LightRAG instance, navigates to the attacker's malicious website.\u003c/li\u003e\n\u003cli\u003eEmbedded JavaScript on \u003ccode\u003eattacker.com\u003c/code\u003e sends a cross-origin HTTP request to the LightRAG server (e.g., to the \u003ccode\u003e/login\u003c/code\u003e endpoint) with the \u003ccode\u003ecredentials: \u0026quot;include\u0026quot;\u003c/code\u003e option.\u003c/li\u003e\n\u003cli\u003eThe LightRAG server, due to its misconfigured \u003ccode\u003eCORSMiddleware\u003c/code\u003e (\u003ccode\u003eallow_origins=[\u0026quot;*\u0026quot;]\u003c/code\u003e and \u003ccode\u003eallow_credentials=True\u003c/code\u003e), processes the preflight request and responds with \u003ccode\u003eAccess-Control-Allow-Origin\u003c/code\u003e set to \u003ccode\u003eattacker.com\u003c/code\u003e and \u003ccode\u003eAccess-Control-Allow-Credentials: true\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe victim's browser, observing the permissive CORS headers, allows the malicious script to continue making authenticated requests using the victim's session cookies or authentication tokens.\u003c/li\u003e\n\u003cli\u003eThe malicious script then makes subsequent authenticated GET requests to sensitive LightRAG API endpoints (e.g., \u003ccode\u003e/documents\u003c/code\u003e) to retrieve user data.\u003c/li\u003e\n\u003cli\u003eThe LightRAG server responds to these requests as if they were legitimate, returning sensitive information like documents or knowledge graph data.\u003c/li\u003e\n\u003cli\u003eThe attacker's website subsequently exfiltrates the retrieved sensitive data or issues commands to perform destructive actions, such as deleting the document store.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability represents a permissive cross-domain policy (CWE-942) that allows any website visited by an authenticated LightRAG user to silently make authenticated API requests. The direct consequence is unauthorized access and manipulation of user data. Attackers can exfiltrate sensitive information, including all documents and knowledge graph data, or perform destructive actions such as deleting the entire document store, without the victim's explicit consent or knowledge. There are no reported numbers of victims or specific sectors targeted, but any organization using vulnerable LightRAG versions is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-61736 by upgrading the \u003ccode\u003elightrag-hku\u003c/code\u003e package to version 1.5.4 or later immediately.\u003c/li\u003e\n\u003cli\u003eReview LightRAG web server access logs for unusual \u003ccode\u003eOrigin\u003c/code\u003e headers combined with requests to sensitive API endpoints, especially those not matching your known allowed origins.\u003c/li\u003e\n\u003cli\u003eEnsure that the \u003ccode\u003eCORS_ORIGINS\u003c/code\u003e configuration for LightRAG is set to specific, trusted domains rather than a wildcard (\u003ccode\u003e*\u003c/code\u003e) when \u003ccode\u003eallow_credentials\u003c/code\u003e is \u003ccode\u003eTrue\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eImplement security best practices for web applications, including secure credential handling and strict CORS policies.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-20T21:46:35Z","date_published":"2026-07-20T21:46:35Z","id":"https://feed.craftedsignal.io/briefs/2026-07-lightrag-cors-vulnerability/","summary":"The LightRAG application, specifically the 'lightrag-hku' package, contains a critical vulnerability (CVE-2026-61736) due to its default Cross-Origin Resource Sharing (CORS) configuration, enabling any malicious website to perform authenticated API calls on behalf of a logged-in LightRAG user, leading to unauthorized data exfiltration or destructive actions.","title":"LightRAG CORS Misconfiguration Allows Credentialed Cross-Origin Requests (CVE-2026-61736)","url":"https://feed.craftedsignal.io/briefs/2026-07-lightrag-cors-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - Cors-Misconfiguration","version":"https://jsonfeed.org/version/1.1"}