The LightRAG API server is vulnerable to unauthenticated access, allowing remote attackers to read, modify, or delete sensitive data and consume infrastructure resources.

The application binds its API server to all network interfaces with authentication disabled by default. This missing authentication vulnerability allows any unauthenticated network attacker to perform administrative actions, including data manipulation and resource exhaustion.

With a CVSS score of 9.8, this vulnerability represents a critical threat to data confidentiality and availability. Unauthorized access to RAG-based systems can lead to the exposure of sensitive indexed documents, corruption of the underlying knowledge base, and significant financial loss due to the unauthorized consumption of LLM API resources.

Immediate Action: Update HKUDS LightRAG to version 1.5.5rc1 or later to enforce mandatory authentication on the API server.

Proactive Monitoring: Audit network configurations to ensure the API server is not exposed to untrusted networks and monitor logs for unauthorized API calls.

Compensating Controls: Implement strict network-level access controls or VPN requirements to restrict access to the LightRAG API to authorized internal entities only.

Public Exploit Available: Unknown — there is no confirmed public exploit in the available data.

Organizations utilizing LightRAG must treat this as a high-priority remediation task. Ensure that the software is updated to the fixed version and verify that the API is not exposed to the public internet until authentication controls are properly implemented and validated.