PyPI/lightrag-hku CVE-2026-61740: critical 9.3, EPSS 0.51%

LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection

Action: Upgrade lightrag-hku to 1.5.4 or later.

pip install lightrag-hku==1.5.4

Affected

Fixed versions

Sources

• osv: GHSA-f4vv-55c2-5789
• nvd: CVE-2026-61740
• https://github.com/HKUDS/LightRAG/security/advisories/GHSA-f4vv-55c2-5789
• https://github.com/HKUDS/LightRAG/pull/3319
• https://github.com/HKUDS/LightRAG/commit/f7819aa3a49a9d8d92eed8251d82d6ebcafa8cba
• https://github.com/HKUDS/LightRAG
• https://github.com/HKUDS/LightRAG/releases/tag/v1.5.4

CVE-2026-61740 · published 2026-07-20T21:46:37Z · modified 2026-07-23T15:11:48.606200820Z · JSON