cyfenced.com →

[ CVE-2026-85709 · Published 22 Sep 2026 ]

lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

CVSS 5.3 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text from error handlers in document_routes.py, graph_routes.py, query_routes.py, ollama_api.py, and lightrag_server.py. The detail=str(e), detail=str(exc), and equivalent formatted-message paths expose server filesystem paths, database host, port, user, and database names, language-model provider diagnostics, configuration details, and Python library internals to a network client that can trigger an error. The default unauthenticated configuration makes those responses reachable without credentials, and URI-configured backends can disclose connection strings containing credentials depending on the underlying driver error. This issue is fixed in version 1.5.5.

[ Fixes ]Fixes and patches

  • lightrag-hku 1.5.5Fixed version · GitHub Advisories · pip package lightrag-hku: upgrade to 1.5.5 or later (affected <= 1.5.4)

[ Packages ]Affected open-source packages

[ References ]References