CyberRota Analysis
AI-GeneratedThe LightRAG API server, up to version 1.5.4, is vulnerable due to its default configuration that binds to all network interfaces without authentication, enabling unauthenticated attackers to access and manipulate sensitive data and resources. This critical vulnerability allows for unauthorized reading, uploading, deleting of documents, and modification of the knowledge graph, posing significant risks to data integrity and availability. Organizations using LightRAG should prioritize upgrading to version 1.5.5rc1 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modify the knowledge graph, cancel pipelines, clear caches, and consume LLM resources. This issue is mitigated in version 1.5.5rc1.