Skip to content
Threat Feed
Subscribe

Vendor

LightRAG

1 brief RSS
critical advisory

LightRAG CORS Misconfiguration Allows Credentialed Cross-Origin Requests (CVE-2026-61736)

The LightRAG application, specifically the 'lightrag-hku' package, contains a critical vulnerability (CVE-2026-61736) due to its default Cross-Origin Resource Sharing (CORS) configuration, enabling any malicious website to perform authenticated API calls on behalf of a logged-in LightRAG user, leading to unauthorized data exfiltration or destructive actions.

lightrag-hku cors-misconfiguration web-vulnerability data-exfiltration cve
2t 1c